npm
@langchain/core
1 versiondiscovered · its AI-security audit & verification record by name.
0.3.18auditedresolved-commitverified
coverage →langchain-ai/langchainjs @ a1b2c3d4e5f60718…/langchain-core
AI security assessmentcleanqwen2.5-7b-instruct
Message/prompt plumbing only; no execution sinks in the reviewed surface.
Methodology
Sources @ a1b2c3d4e5
README.md, langchain-core/src/messages/base.ts, langchain-core/src/prompts/chat.ts, langchain-core/src/runnables/base.ts, langchain-core/src/tools/index.ts, langchain-core/src/callbacks/manager.ts
Parts 6 files, 12400 bytes
Techniques llm-static-source-review, prompt-injection-detection, insecure-tool-and-function-calling, unsafe-eval-exec-of-model-output, ssrf-detection, secret-exposure-detection, classic-software-vulnerability-review
Parameters qwen2.5-7b-instruct · temp 0 · max 900 tok · local
classes examined: CWE-77
Independently verified by
Gate this package in CI
Fail the build on an attested vulnerability or registry tampering, and emit skip-scan excludes for audited files — one command against the registry.
signet gate --purl pkg:npm/%40langchain/core@0.3.18 --registry https://signet.seekerslab.com
README badge
Show this package's Signet status in its README — audited, AI pre-screened, or unaudited. Updates within an hour of a new attestation.
