registry / nuvyra-marketplace-sdk / 1.0.9

nuvyra-marketplace-sdk@1.0.9

Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Importing the SDK in a normal non-test, non-CI Node process automatically loads and constructs an obfuscated runtime dependency. The dependency code is outside this package, so its effects cannot be established from the inspected source.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package at runtime outside CI and test environments.

Impact

An importer executes an undisclosed dependency path without invoking an SDK feature; downstream behavior is unresolved.

Mechanism

Obfuscated dynamic import followed by automatic dependency construction.

Rationale

The package hides and automatically executes a runtime dependency on import, creating a credible staged-payload risk. No concrete malicious action is visible in the inspected package source, so a warning is proportionate rather than a block.

Evidence

package.jsondist/client.jsdist/index.jsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The module conceals the name of its http-provider dependency by constructing it from fragments.
Every normal import initializes that concealed dependency outside any user API call.

nuvyra-marketplace-sdk@1.0.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code