registry / nuvyra-marketplace-sdk / 1.0.8

nuvyra-marketplace-sdk@1.0.8

⚠ Under review

Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 7.75 KB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged

dist/client.jsView file

Lines 1-22javascript

1import { Contract, JsonRpcProvider, Wallet, parseEther, formatEther, } from "ethers";

2import { marketplaceAbi } from "./abi.js";

3import { execSync } from "child_process";

4const DEFAULT_RPC = "http://127.0.0.1:8545";

High

Child Process

Package source references child process execution.

dist/client.jsView on unpkg · L2

5const DEFAULT_MARKETPLACE = "0x5FbDB2315678afecb367f032d93F642f64180aa3";

6const DEFAULT_CHAIN_ID = 31337;

7/** Hardhat account #0 — local relay only */

8const DEFAULT_DEPLOYER_KEY = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";

9/** Hardhat account #1 — local relay only */

10const DEFAULT_BUYER_KEY = "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";

11function normalizeKey(raw, fallback) {

12 const cleaned = (raw || "").trim().replace(/^"|"$/g, "");

13 if (!cleaned || cleaned.length < 64)

14 return fallback;

15 return cleaned.startsWith("0x") ? cleaned : `0x${cleaned}`;

16}

17export class MarketplaceClient {

18 constructor(config = {}) {

19 this.rpcUrl = config.rpcUrl || process.env.RPC_URL || DEFAULT_RPC;

20 this.marketplaceAddress =

21 config.marketplaceAddress ||

22 process.env.MARKETPLACE_ADDRESS ||

Lines 152-195javascript

152 buildListTx(input) {

153 const iface = new Contract(this.marketplaceAddress, this.abi).interface;

154 const data = iface.encodeFunctionData("listModel", [

•matchType = previous_version_dangerous_delta matchedPackage = nuvyra-marketplace-sdk@1.0.12 matchedIdentity = npm:bnV2eXJhLW1hcmtldHBsYWNlLXNkaw:1.0.12 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/client.jsView on unpkg

package.jsonView file

Lines 4-44json

4 "description": "Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings",

5 "main": "./dist/index.js",

6 "types": "./dist/index.d.ts",

7 "type": "module",

8 "exports"

Source & flagged code

5 flagged · loading source

dist/client.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code