@premai/api-sdk
End-to-end encrypted OpenAI-compatible client with file upload and tools support, using XWing (ML-KEM768 + X25519) hybrid post-quantum encryption.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Framework type package used by convention, not direct import. | ai | |
| source-diff | obfuscated-file:dist/bare.cjs | AI (source-diff): Bundled Bare-runtime build output, not obfuscation; matches documented ./bare export. | ai | |
| source-diff | obfuscated-file:dist/bare.mjs | AI (source-diff): Bundled Bare-runtime build output, not obfuscation; matches documented ./bare export. | ai | |
| phantom-deps | phantom-dep:@premai/bare-wasm3 | AI (phantom-deps): Same-org scoped dep, loaded indirectly by bare runtime. | ai | |
| phantom-deps | phantom-dep:bare-fs | AI (phantom-deps): bare-fs is used via package.json imports map as a Bare runtime polyfill for 'fs', not a direct import. | ai | |
| typosquat | typosquat.levenshtein:aws-sdk | AI (typosquat): @premai/api-sdk is a scoped SDK for the premai.io platform, not a typosquat of aws-sdk; Levenshtein match is coincidental. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): typescript is a build-time dep legitimately listed; phantom detection is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:@noble/curves | AI (phantom-deps): @noble/curves is used transitively via crypto stack; phantom detection is a false positive here. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 1.0.55 | 30 / 6 | |
| 1.0.43 | 28 / 6 | |
| 1.0.42 | 23 / 6 | |
| 1.0.41 | 19 / 6 | |
| 1.0.40 | 19 / 6 | |
| 1.0.39 | 19 / 6 | |
| 1.0.38 | 19 / 6 | |
| 1.0.37 | 19 / 6 | |
| 1.0.36 | 19 / 6 | |
| 1.0.35 | 19 / 6 | |
| 1.0.34 | 19 / 6 | |
| 1.0.33 | 19 / 6 | |
| 1.0.32 | 19 / 6 | |
| 1.0.31 | 13 / 6 | |
| 1.0.30 | 13 / 6 | |
| 1.0.29 | 13 / 6 |
v1.0.55
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.34
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.