@ai-sdk/azure 4.0.125
PkgFire would install this release with a warning.·Checked 1 hour ago·Published 13 November 2026
Why
-
warnRelease cooldown
Published 17 hours ago, inside the 7-day cooldown. Most malicious releases are pulled within hours of publication, so a version this new has not yet had time to be caught.
Provenance
A registry signature proves the registry served these bytes unaltered. Build provenance proves which workflow built them from which commit; a stolen publishing token can fake the first but not the second.
- Signature
- Verified against the registry's key
- Build provenance
- Attested · source commit ↗
What the code does
On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.
Source patterns
Patterns found in the source, including those malware is known to use.
Other checked releases
3.0.154warn13 Nov 20264.0.126warn13 Nov 20264.0.125warn13 Nov 20264.0.124warn12 Nov 20263.0.153warn12 Nov 20264.0.123warn11 Nov 20263.0.152warn11 Nov 20262.0.150warn11 Nov 20264.0.122warn10 Nov 20264.0.121warn10 Nov 20263.0.151warn10 Nov 20262.0.149warn10 Nov 20264.0.119warn7 Nov 20263.0.150warn7 Nov 20262.0.148warn7 Nov 20263.0.149allow6 Nov 20264.0.118allow6 Nov 20264.0.117allow5 Nov 20263.0.148allow5 Nov 20263.0.147allow3 Nov 2026
Check every dependency before it installs
This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.