npm JavaScript analyzed 10.8.5

@juspay/neurolink

v10.8.5

TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and mo

maintainer: balaganesh_juspay
license: MIT
first seen: 2026-05-22
last seen: 2026-08-02
releases · 30d: 179
short id

Drift inferred · capture-to-capture

HIGH 2026-07-22 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-22 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-20 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-20 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-20 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-18 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-11 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-11 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-10 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-10 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-09 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-09 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-05 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-04 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-02 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-07-02 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-07-01 code analysis flagged committed secret ×2, dynamic code execution ×4 in @juspay/neurolink
HIGH 2026-06-30 code analysis flagged committed secret, dynamic code execution ×4 in juspay/neurolink
HIGH 2026-06-21 code analysis flagged committed secret ×2 in @juspay/neurolink
HIGH 2026-06-09 code analysis flagged committed secret ×2, dynamic code execution ×8 in @juspay/neurolink

capabilities 1 tools

transport stdio · streamable-http · http counts 1 tools · 0 res · 0 prompts permission surface via code analysis

tools

retrieve_context

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v10.8.5 · analyzer v28 · 2h ago

danger signals17

dynamic code execution new Function() package/dist/agent/directTools.js :224 const result = new Function(`'use strict'; return (${expression})`)();
dynamic code execution new Function() package/dist/lib/agent/directTools.js :224 const result = new Function(`'use strict'; return (${expression})`)();
dynamic code execution new Function() package/dist/lib/utils/schemaConversion.js :623 const createZodSchema = new Function("z", `return ${schemaExpression}`);
dynamic code execution new Function() package/dist/utils/schemaConversion.js :623 const createZodSchema = new Function("z", `return ${schemaExpression}`);
suspicious endpoint app.posthog.com (telemetry) package/dist/cli/commands/telemetry.js :683 POSTHOG_HOST: "https://app.posthog.com (optional)",
suspicious endpoint api.datadoghq.com (telemetry) package/dist/lib/observability/exporters/datadogExporter.js :36 ? "https://api.datadoghq.com/api/v1/validate"
suspicious endpoint app.posthog.com (telemetry) package/dist/lib/observability/exporters/posthogExporter.js :20 this.host = config.host ?? "https://app.posthog.com";
suspicious endpoint api.datadoghq.com (telemetry) package/dist/observability/exporters/datadogExporter.js :36 ? "https://api.datadoghq.com/api/v1/validate"
suspicious endpoint app.posthog.com (telemetry) package/dist/observability/exporters/posthogExporter.js :20 this.host = config.host ?? "https://app.posthog.com";
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose package/dist/adapters/video/vertexVideoHandler.js :160 scopes: ["https://www.googleapis.com/auth/cloud-platform"],
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose package/dist/lib/adapters/video/vertexVideoHandler.js :160 scopes: ["https://www.googleapis.com/auth/cloud-platform"],
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose package/dist/lib/providers/googleVertex/client.js :6885 scopes: ["https://www.googleapis.com/auth/cloud-platform"],
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose package/dist/lib/voice/providers/GoogleSTT.js :432 scopes: ["https://www.googleapis.com/auth/cloud-platform"],
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose package/dist/providers/googleVertex/client.js :6885 scopes: ["https://www.googleapis.com/auth/cloud-platform"],
over-broad OAuth scope https://www.googleapis.com/auth/cloud-platform expected for this server's purpose package/dist/voice/providers/GoogleSTT.js :432 scopes: ["https://www.googleapis.com/auth/cloud-platform"],
committed secret Anthropic key package/dist/lib/utils/providerSetupMessages.js :23 sk-ant…(31 chars, redacted)
committed secret Anthropic key package/dist/utils/providerSetupMessages.js :23 sk-ant…(31 chars, redacted)

code evidence v10.8.5 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1750

filesystem 68

fs package/dist/action/actionExecutor.js :8 import * as fs from "fs";
fs package/dist/adapters/video/ffmpegAdapter.js :13 import { readdirSync, rmdirSync, unlinkSync } from "node:fs";
fs package/dist/adapters/video/vertexVideoHandler.js :12 import { readFile } from "node:fs/promises";
fs package/dist/adapters/video/videoAnalyzer.js :11 import { readFile } from "node:fs/promises";
fs package/dist/agent/directTools.js :2 import * as fs from "fs";
fs package/dist/artifacts/artifactStore.js :21 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
fs package/dist/auth/tokenStore.js :15 import { promises as fs } from "fs";
fs package/dist/autoresearch/config.js :4 import { existsSync, statSync } from "node:fs";
fs package/dist/autoresearch/promptCompiler.js :7 import { readFileSync, statSync } from "node:fs";
fs package/dist/autoresearch/resultRecorder.js :4 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
fs package/dist/autoresearch/runner.js :5 import { writeFileSync } from "node:fs";
fs package/dist/autoresearch/stateStore.js :4 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
fs package/dist/autoresearch/tools.js :11 import { existsSync, readFileSync, writeFileSync } from "node:fs";
fs package/dist/cli/commands/agent.js :16 import fs from "fs";
fs package/dist/cli/commands/auth.js :20 import fs from "fs";
fs package/dist/cli/commands/autoresearch.js :14 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
fs package/dist/cli/commands/config.js :9 import fs from "fs";
fs package/dist/cli/commands/evaluate.js :10 import fs from "node:fs";
fs package/dist/cli/commands/mcp.js :18 import fs from "fs";
fs package/dist/cli/commands/proxyReplay.js :1 import { readFile, stat } from "node:fs/promises";
fs package/dist/cli/commands/rag.js :10 import { existsSync } from "fs";
fs package/dist/cli/commands/serve.js :12 import fs from "fs";
fs package/dist/cli/commands/server.js :7 import fs from "fs";
fs package/dist/cli/commands/setup-anthropic.js :11 import fs from "fs";
fs package/dist/cli/commands/setup-bedrock.js :8 import * as fs from "fs";
fs package/dist/cli/commands/setup-gcp.js :13 import fs from "fs";
fs package/dist/cli/commands/setup-mistral.js :4 import fs from "fs";
fs package/dist/cli/commands/setup-openai.js :11 import fs from "fs";
fs package/dist/cli/commands/task.js :19 import { mkdirSync, openSync } from "node:fs";
fs package/dist/cli/factories/commandFactory.js :1 import fs from "node:fs";
fs package/dist/cli/utils/audioFileUtils.js :9 import fs from "fs";
fs package/dist/cli/utils/audioPlayer.js :11 import fs from "node:fs";
fs package/dist/cli/utils/classifierRouterFlags.js :7 import fs from "node:fs";
fs package/dist/cli/utils/envManager.js :6 import fs from "fs";
fs package/dist/cli/utils/inputValidation.js :12 import fs from "node:fs";
fs package/dist/cli/utils/serverUtils.js :5 import fs from "fs";
fs package/dist/cli/utils/toolRoutingFlags.js :7 import fs from "node:fs";
fs package/dist/cli/utils/videoFileUtils.js :10 import fs from "fs";
fs package/dist/config/configManager.js :5 import { promises as fs } from "fs";
fs package/dist/core/baseProvider.js :1825 imageBuffer = await this.executeWithTimeout(() => fs.readFile(imageInput), { timeout: IMAGE_IO_TIMEOUT_MS, operationType: "generate" });
fs package/dist/core/modelConfiguration.js :8 import fs from "fs";
fs package/dist/features/ppt/presentationOrchestrator.js :15 import * as fs from "fs/promises";
fs package/dist/features/ppt/slideGenerator.js :16 import * as fs from "fs";
fs package/dist/features/ppt/utils.js :8 import * as fs from "fs/promises";
fs package/dist/files/fileReferenceRegistry.js :15 import { mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
fs package/dist/files/streamingReader.js :24 import { createReadStream } from "node:fs";
fs package/dist/lib/action/actionExecutor.js :8 import * as fs from "fs";
fs package/dist/lib/adapters/video/ffmpegAdapter.js :13 import { readdirSync, rmdirSync, unlinkSync } from "node:fs";
fs package/dist/lib/adapters/video/vertexVideoHandler.js :12 import { readFile } from "node:fs/promises";
fs package/dist/lib/adapters/video/videoAnalyzer.js :11 import { readFile } from "node:fs/promises";
fs package/dist/lib/agent/directTools.js :2 import * as fs from "fs";
fs package/dist/lib/artifacts/artifactStore.js :21 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
fs package/dist/lib/auth/tokenStore.js :15 import { promises as fs } from "fs";
fs package/dist/lib/autoresearch/config.js :4 import { existsSync, statSync } from "node:fs";
fs package/dist/lib/autoresearch/promptCompiler.js :7 import { readFileSync, statSync } from "node:fs";
fs package/dist/lib/autoresearch/resultRecorder.js :4 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
fs package/dist/lib/autoresearch/runner.js :5 import { writeFileSync } from "node:fs";
fs package/dist/lib/autoresearch/stateStore.js :4 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
fs package/dist/lib/autoresearch/tools.js :11 import { existsSync, readFileSync, writeFileSync } from "node:fs";
fs package/dist/lib/config/configManager.js :5 import { promises as fs } from "fs";
fs package/dist/lib/core/baseProvider.js :1825 imageBuffer = await this.executeWithTimeout(() => fs.readFile(imageInput), { timeout: IMAGE_IO_TIMEOUT_MS, operationType: "generate" });
fs package/dist/lib/core/modelConfiguration.js :8 import fs from "fs";
fs package/dist/lib/features/ppt/presentationOrchestrator.js :15 import * as fs from "fs/promises";
fs package/dist/lib/features/ppt/slideGenerator.js :16 import * as fs from "fs";
fs package/dist/lib/features/ppt/utils.js :8 import * as fs from "fs/promises";
fs package/dist/lib/files/fileReferenceRegistry.js :15 import { mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
fs package/dist/lib/files/streamingReader.js :24 import { createReadStream } from "node:fs";
fs package/dist/lib/mcp/auth/tokenStorage.js :58 const data = await fs.readFile(this.filePath, "utf-8");

shell / exec 22

shell package/dist/adapters/video/ffmpegAdapter.js :161 * Run an FFmpeg command via `child_process.execFile`.
shell package/dist/agent/directTools.js :4 import { execFile } from "child_process";
shell package/dist/autoresearch/repoPolicy.js :7 import { execFileSync } from "node:child_process";
shell package/dist/autoresearch/runner.js :4 import { spawn } from "node:child_process";
shell package/dist/autoresearch/tools.js :10 import { execFileSync } from "node:child_process";
shell package/dist/autoresearch/worker.js :10 import { execFileSync } from "node:child_process";
shell package/dist/cli/commands/auth.js :22 import { execFile } from "child_process";
shell package/dist/cli/commands/ollama.js :1 import { spawnSync } from "child_process";
shell package/dist/cli/commands/proxy.js :12 import { spawn } from "node:child_process";
shell package/dist/cli/commands/task.js :18 import { spawn } from "node:child_process";
shell package/dist/cli/factories/ollamaCommandFactory.js :1 import { spawnSync, } from "child_process";
shell package/dist/cli/utils/audioPlayer.js :9 import { execFile } from "node:child_process";
shell package/dist/cli/utils/ollamaUtils.js :1 import { spawnSync, spawn, } from "child_process";
shell package/dist/lib/adapters/video/ffmpegAdapter.js :161 * Run an FFmpeg command via `child_process.execFile`.
shell package/dist/lib/agent/directTools.js :4 import { execFile } from "child_process";
shell package/dist/lib/autoresearch/repoPolicy.js :7 import { execFileSync } from "node:child_process";
shell package/dist/lib/autoresearch/runner.js :4 import { spawn } from "node:child_process";
shell package/dist/lib/autoresearch/tools.js :10 import { execFileSync } from "node:child_process";
shell package/dist/lib/autoresearch/worker.js :10 import { execFileSync } from "node:child_process";
shell package/dist/lib/mcp/caching/toolCache.js :331 return new RegExp(`^${regexPattern}$`);
shell package/dist/lib/mcp/mcpClientFactory.js :12 import { spawn } from "child_process";
shell package/dist/lib/mcp/serverCapabilities.js :287 return new RegExp(`^${regexPattern}$`).test(uri);

network 53

net package/dist/adapters/replicate/predictionLifecycle.js :55 const response = await fetch(endpoint, {
net package/dist/adapters/video/directorPipeline.js :122 const response = await fetch(url, { signal: controller.signal });
net package/dist/adapters/video/klingVideoHandler.js :257 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/adapters/video/runwayVideoHandler.js :249 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/adapters/video/vertexVideoHandler.js :354 response = await fetch(endpoint, {
net package/dist/auth/anthropicOAuth.js :18 import { createServer } from "http";
net package/dist/auth/providers/CognitoProvider.js :212 const response = await fetch(this.jwksUri, {
net package/dist/auth/providers/KeycloakProvider.js :212 const response = await fetch(this.jwksUri, {
net package/dist/avatar/providers/DIDAvatar.js :452 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/avatar/providers/HeyGenAvatar.js :295 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/avatar/providers/ReplicateAvatar.js :151 r = await fetch(input, { signal: controller.signal });
net package/dist/cli/commands/auth.js :562 const tokenResponse = await fetch(ANTHROPIC_OAUTH_CONFIG.tokenUrl, {
net package/dist/cli/commands/proxy.js :592 const response = await fetch(`http://${host}:${port}/health`, {
net package/dist/client/auth.js :111 const response = await fetch(this.config.tokenUrl, {
net package/dist/client/httpClient.js :238 const response = await this.config.fetch(url, {
net package/dist/client/reactHooks.js :895 const res = await fetch(api, {
net package/dist/client/reactHooks.tsx :1162 const res = await fetch(api, {
net package/dist/client/sseClient.js :131 const response = await fetch(url, {
net package/dist/client/streamingClient.js :87 const response = await fetch(this.url, {
net package/dist/core/baseProvider.js :290 * which is bypassed by providers that stream via raw HTTP fetch (Ollama
net package/dist/core/dynamicModels.js :109 const response = await fetch(source, {
net package/dist/features/ppt/slideGenerator.js :90 const response = await withTimeout(fetch(image), USER_IMAGE_IO_TIMEOUT_MS, ErrorFactory.toolTimeout("userImageFetch", USER_IMAGE_IO_TIMEOUT_MS));
net package/dist/lib/adapters/replicate/predictionLifecycle.js :55 const response = await fetch(endpoint, {
net package/dist/lib/adapters/video/directorPipeline.js :122 const response = await fetch(url, { signal: controller.signal });
net package/dist/lib/adapters/video/klingVideoHandler.js :257 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/lib/adapters/video/runwayVideoHandler.js :249 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/lib/adapters/video/vertexVideoHandler.js :354 response = await fetch(endpoint, {
net package/dist/lib/auth/anthropicOAuth.js :18 import { createServer, IncomingMessage, ServerResponse } from "http";
net package/dist/lib/auth/providers/CognitoProvider.js :212 const response = await fetch(this.jwksUri, {
net package/dist/lib/auth/providers/KeycloakProvider.js :212 const response = await fetch(this.jwksUri, {
net package/dist/lib/avatar/providers/DIDAvatar.js :452 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/lib/avatar/providers/HeyGenAvatar.js :295 return await fetch(url, { ...init, signal: controller.signal });
net package/dist/lib/avatar/providers/ReplicateAvatar.js :151 r = await fetch(input, { signal: controller.signal });
net package/dist/lib/client/auth.js :111 const response = await fetch(this.config.tokenUrl, {
net package/dist/lib/client/httpClient.js :238 const response = await this.config.fetch(url, {
net package/dist/lib/client/reactHooks.js :895 const res = await fetch(api, {
net package/dist/lib/client/sseClient.js :131 const response = await fetch(url, {
net package/dist/lib/client/streamingClient.js :87 const response = await fetch(this.url, {
net package/dist/lib/core/baseProvider.js :290 * which is bypassed by providers that stream via raw HTTP fetch (Ollama
net package/dist/lib/core/dynamicModels.js :109 const response = await fetch(source, {
net package/dist/lib/features/ppt/slideGenerator.js :91 const response = await withTimeout(fetch(image), USER_IMAGE_IO_TIMEOUT_MS, ErrorFactory.toolTimeout("userImageFetch", USER_IMAGE_IO_TIMEOUT_MS));
net package/dist/lib/mcp/auth/oauthClientProvider.js :154 const response = await withTimeout(fetch(this.config.tokenUrl, {
net package/dist/lib/mcp/httpRetryHandler.js :117 * const response = await fetch(url);
net package/dist/lib/mcp/mcpClientFactory.js :403 return await fetch(input, { ...init, signal: controller.signal });
net package/dist/lib/music/providers/BeatovenMusic.js :129 response = await fetch(`${this.baseUrl}/api/v1/tracks/compose`, {
net package/dist/lib/music/providers/ElevenLabsMusic.js :91 response = await fetch(`${this.baseUrl}/sound-generation`, {
net package/dist/lib/music/providers/LyriaMusic.js :91 response = await fetch(`${this.baseUrl}/models/${this.model}:generateContent?key=${this.apiKey}`, {
net package/dist/lib/music/providers/ReplicateMusic.js :175 r = await fetch(input, { signal: controller.signal });
net package/dist/lib/neurolink.js :2212 const response = await fetch("http://localhost:11434/api/tags", {
net package/dist/lib/observability/exporters/arizeExporter.js :34 const response = await fetch(`${this.endpoint}/log`, {
net package/dist/lib/observability/exporters/braintrustExporter.js :27 const response = await fetch(`${this.endpoint}/v1/project`, {
net package/dist/lib/observability/exporters/datadogExporter.js :38 const response = await fetch(validateUrl, {
net package/dist/lib/observability/exporters/laminarExporter.js :29 const response = await fetch(`${this.baseUrl}/v1/health`, {

secrets 57

secrets package/dist/action/actionInputs.js :182 githubToken: core.getInput("github_token") || process.env.GITHUB_TOKEN,
secrets package/dist/adapters/replicate/auth.js :21 process.env.REPLICATE_API_TOKEN ??
secrets package/dist/adapters/tts/cartesiaHandler.js :19 const apiKey = process.env.CARTESIA_API_KEY;
secrets package/dist/adapters/tts/googleTTSHandler.js :33 credentialsPath ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
secrets package/dist/adapters/video/klingVideoHandler.js :43 const resolved = (apiKey ?? process.env.KLING_API_KEY ?? "").trim();
secrets package/dist/adapters/video/runwayVideoHandler.js :40 const resolved = (apiKey ?? process.env.RUNWAY_API_KEY ?? "").trim();
secrets package/dist/adapters/video/vertexVideoHandler.js :79 return !!(process.env.GOOGLE_APPLICATION_CREDENTIALS ||
secrets package/dist/adapters/video/videoAnalyzer.js :151 const apiKey = options.apiKey || process.env.GOOGLE_AI_API_KEY;
secrets package/dist/agent/directTools.js :594 const hasCredentials = process.env.GOOGLE_APPLICATION_CREDENTIALS;
secrets package/dist/auth/anthropicOAuth.js :296 config.clientSecret || process.env.ANTHROPIC_OAUTH_CLIENT_SECRET;
secrets package/dist/auth/providers/auth0.js :160 const managementToken = process.env.AUTH0_MANAGEMENT_TOKEN;
secrets package/dist/avatar/providers/DIDAvatar.js :36 process.env.DID_API_KEY ??
secrets package/dist/avatar/providers/HeyGenAvatar.js :33 const resolved = (apiKey ?? process.env.HEYGEN_API_KEY ?? "").trim();
secrets package/dist/cli/commands/auth.js :1130 const envKey = process.env.ANTHROPIC_API_KEY?.trim();
secrets package/dist/cli/commands/authProviders.js :271 const secretKey = argv.secretKey || process.env.CLERK_SECRET_KEY;
secrets package/dist/cli/commands/proxy.js :57 const PROXY_UPDATE_CONTROL_TOKEN = process.env.NEUROLINK_PROXY_UPDATE_CONTROL_TOKEN?.trim() ||
secrets package/dist/cli/commands/setup-anthropic.js :28 const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
secrets package/dist/cli/commands/setup-azure.js :28 const hasApiKey = !!process.env.AZURE_OPENAI_API_KEY;
secrets package/dist/cli/commands/setup-bedrock.js :148 hasSecretKey: !!process.env.AWS_SECRET_ACCESS_KEY,
secrets package/dist/cli/commands/setup-gcp.js :115 const hasCredentials = !!process.env.GOOGLE_APPLICATION_CREDENTIALS;
secrets package/dist/cli/commands/setup-google-ai.js :35 const hasApiKey = !!(process.env.GOOGLE_AI_API_KEY || process.env.GOOGLE_GENERATIVE_AI_API_KEY);
secrets package/dist/cli/commands/setup-huggingface.js :17 const apiKey = process.env.HUGGINGFACE_API_KEY || process.env.HF_TOKEN;
secrets package/dist/cli/commands/setup-mistral.js :61 const apiKey = process.env.MISTRAL_API_KEY;
secrets package/dist/cli/commands/setup-openai.js :28 const hasApiKey = !!process.env.OPENAI_API_KEY;
secrets package/dist/cli/commands/setup.js :257 if (process.env.GOOGLE_AI_API_KEY ||
secrets package/dist/cli/factories/commandFactory.js :813 const envValue = process.env.NEUROLINK_PDF_PASSWORD;
secrets package/dist/client/aiSdkAdapter.js :331 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/client/auth.js :313 * apiKey: process.env.API_KEY,
secrets package/dist/client/httpClient.js :843 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/client/index.js :17 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/client/reactHooks.js :41 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/client/reactHooks.tsx :82 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/core/conversationMemoryFactory.js :105 REDIS_PASSWORD: process.env.REDIS_PASSWORD ? "******" : "(not set)",
secrets package/dist/core/conversationMemoryInitializer.js :110 hasPassword: !!process.env.REDIS_PASSWORD,
secrets package/dist/lib/action/actionInputs.js :182 githubToken: core.getInput("github_token") || process.env.GITHUB_TOKEN,
secrets package/dist/lib/adapters/replicate/auth.js :21 process.env.REPLICATE_API_TOKEN ??
secrets package/dist/lib/adapters/tts/cartesiaHandler.js :19 const apiKey = process.env.CARTESIA_API_KEY;
secrets package/dist/lib/adapters/tts/googleTTSHandler.js :33 credentialsPath ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
secrets package/dist/lib/adapters/video/klingVideoHandler.js :43 const resolved = (apiKey ?? process.env.KLING_API_KEY ?? "").trim();
secrets package/dist/lib/adapters/video/runwayVideoHandler.js :40 const resolved = (apiKey ?? process.env.RUNWAY_API_KEY ?? "").trim();
secrets package/dist/lib/adapters/video/vertexVideoHandler.js :79 return !!(process.env.GOOGLE_APPLICATION_CREDENTIALS ||
secrets package/dist/lib/adapters/video/videoAnalyzer.js :151 const apiKey = options.apiKey || process.env.GOOGLE_AI_API_KEY;
secrets package/dist/lib/agent/directTools.js :594 const hasCredentials = process.env.GOOGLE_APPLICATION_CREDENTIALS;
secrets package/dist/lib/auth/anthropicOAuth.js :296 config.clientSecret || process.env.ANTHROPIC_OAUTH_CLIENT_SECRET;
secrets package/dist/lib/auth/providers/auth0.js :160 const managementToken = process.env.AUTH0_MANAGEMENT_TOKEN;
secrets package/dist/lib/avatar/providers/DIDAvatar.js :36 process.env.DID_API_KEY ??
secrets package/dist/lib/avatar/providers/HeyGenAvatar.js :33 const resolved = (apiKey ?? process.env.HEYGEN_API_KEY ?? "").trim();
secrets package/dist/lib/client/aiSdkAdapter.js :331 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/lib/client/auth.js :313 * apiKey: process.env.API_KEY,
secrets package/dist/lib/client/httpClient.js :843 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/lib/client/index.js :17 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/lib/client/reactHooks.js :41 * apiKey: process.env.NEUROLINK_API_KEY,
secrets package/dist/lib/core/conversationMemoryFactory.js :105 REDIS_PASSWORD: process.env.REDIS_PASSWORD ? "******" : "(not set)",
secrets package/dist/lib/core/conversationMemoryInitializer.js :110 hasPassword: !!process.env.REDIS_PASSWORD,
secrets package/dist/lib/music/providers/BeatovenMusic.js :46 const resolved = (apiKey ?? process.env.BEATOVEN_API_KEY ?? "").trim();
secrets package/dist/lib/music/providers/ElevenLabsMusic.js :39 const resolved = (apiKey ?? process.env.ELEVENLABS_API_KEY ?? "").trim();
secrets package/dist/lib/music/providers/LyriaMusic.js :44 process.env.GOOGLE_AI_LYRIA_API_KEY ??

tool registrations 2

retrieve_context package/dist/lib/neurolink.js :1315
retrieve_context package/dist/neurolink.js :1315

install hooks 2

prepare package/package.json :42 git rev-parse --git-dir > /dev/null 2>&1 && husky install || echo 'Skipping husky in non-git environment'
prepack package/package.json :43 svelte-kit sync && svelte-package && pnpm run build:react-hooks && pnpm run build:cli && pnpm run build:browser && publint

declared dependencies 159

@modelcontextprotocol/sdk@^1.27.1
@ai-sdk/anthropic@^3.0.50
@ai-sdk/google@^4.0.29
@ai-sdk/google-vertex@^5.0.36
@ai-sdk/mistral@^3.0.21
@ai-sdk/openai@^3.0.37
@ai-sdk/provider@^3.0.8
@anthropic-ai/sdk@^0.102.0
@anthropic-ai/vertex-sdk@^0.16.0
@aws-sdk/types@^3.862.0
@cfworker/json-schema@^4.1.1
@google/genai@^1.43.0
@opentelemetry/api-logs@^0.214.0
@opentelemetry/context-async-hooks@^2.6.1
@opentelemetry/core@^2.8.0
@opentelemetry/exporter-logs-otlp-http@^0.214.0
@opentelemetry/exporter-metrics-otlp-http@^0.214.0
@opentelemetry/exporter-trace-otlp-http@^0.214.0
@opentelemetry/resources@^2.6.0
@opentelemetry/sdk-logs@^0.214.0
@opentelemetry/sdk-metrics@^2.6.1
@opentelemetry/sdk-trace-base@^2.6.0
@opentelemetry/semantic-conventions@^1.40.0
adm-zip@^0.5.16
ai@^6.0.134
chalk@^5.6.2
chardet@2.1.1
croner@^9.1.0
csv-parser@^3.2.0
dotenv@^17.3.1
eventsource-parser@^3.0.8
fast-xml-parser@^5.7.0
google-auth-library@^10.6.1
hono@^4.12.21
iconv-lite@0.7.2
inquirer@^13.3.0
jose@^6.1.3
js-yaml@^4.2.0
json-schema-to-zod@^2.7.0
jsonrepair@^3.14.0
nanoid@^5.1.5
open@^11.0.0
ora@^9.3.0
p-limit@^7.3.0
redis@^5.11.0
tar-stream@^3.1.8
type-decoder@^2.3.1
undici@>=7.24.0 <8.0.0
ws@^8.20.1
yargs@^18.0.0
zod@^4.3.6
zod-to-json-schema@^3.25.1
@actions/core@^3.0.0
@actions/exec@^3.0.0
@actions/github@^9.0.0
@biomejs/biome@^2.4.4
@changesets/changelog-github@^0.6.0
@changesets/cli@^2.29.8
@electric-sql/pglite@^0.4.6
@eslint/js@^10.0.1
@juspay/hippocampus@>=0.1.7
@opentelemetry/api@^1.9.0
@opentelemetry/sdk-trace-node@^2.6.0
@semantic-release/changelog@^6.0.3
@semantic-release/commit-analyzer@^13.0.1
@semantic-release/git@^10.0.1
@semantic-release/github@^12.0.6
@semantic-release/npm@^13.1.4
@semantic-release/release-notes-generator@^14.1.0
@smithy/types@^4.13.0
@sveltejs/adapter-auto@^7.0.1
@sveltejs/kit@^2.60.1
@sveltejs/package@^2.5.7
@sveltejs/vite-plugin-svelte@^7.0.0
@types/adm-zip@^0.5.7
@types/cors@^2.8.19
@types/express@^5.0.6
@types/fluent-ffmpeg@^2.1.28
@types/inquirer@^9.0.9
@types/js-yaml@^4.0.9
@types/koa@^3.0.1
@types/koa-bodyparser@^4.3.13
@types/koa__cors@^5.0.1
@types/node@^25.3.3
@types/react@^19.2.10
@types/tar-stream@^3.1.4
@types/ws@^8.18.1
@types/yargs@^17.0.35
@typescript-eslint/eslint-plugin@^8.57.2
@typescript-eslint/parser@^8.57.2
@vercel/ncc@^0.38.4
@vitest/coverage-v8@^4.1.0
concurrently@^9.2.1
conventional-changelog-conventionalcommits@^9.1.0
esbuild@^0.28.1
eslint@^10.0.2
husky@^9.1.7
lint-staged@^16.3.0
playwright@^1.58.2
prettier@^3.8.1
publint@^0.3.17
puppeteer@^24.37.5
react@^19.2.4
react-dom@^19.2.4
semantic-release@^25.0.3
shell-quote@^1.8.4
svelte@^5.55.7
svelte-check@^4.4.4
ts-morph@^24.0.0
tslib@^2.8.1
tsx@^4.21.0
typedoc@^0.28.17
typedoc-plugin-markdown@^4.10.0
typescript@^5.9.3
vite@^8.0.5
vitest@^4.1.0
why-is-node-running@^3.2.2
@aws-sdk/client-bedrock@^3.1000.0
@aws-sdk/client-bedrock-runtime@^3.1000.0
@aws-sdk/client-sagemaker@^3.1000.0
@aws-sdk/client-sagemaker-runtime@^3.1000.0
@aws-sdk/credential-provider-node@^3.886.0
@fastify/cors@^11.2.0
@fastify/rate-limit@^10.3.0
@google-cloud/text-to-speech@^6.4.0
@google-cloud/vertexai@^1.10.0
@hono/node-server@^1.19.13
@huggingface/inference@^4.13.14
@koa/cors@^5.0.0
@koa/router@^15.3.1
@langfuse/otel@^5.0.1
@livekit/agents@^1.4.5
@livekit/agents-plugin-cartesia@^1.4.5
@livekit/agents-plugin-deepgram@^1.4.5
@livekit/agents-plugin-elevenlabs@^1.4.5
@livekit/agents-plugin-google@^1.4.5
@livekit/agents-plugin-livekit@^1.4.5
@livekit/agents-plugin-silero@^1.4.5
@livekit/agents-plugin-soniox@^1.4.5
@livekit/rtc-node@^0.13.29
@picovoice/cobra-node@^3.0.2
bullmq@^5.52.2
cors@^2.8.5
exceljs@^4.4.0
express@^5.1.0
express-rate-limit@^8.2.1
fastify@^5.8.5
ffmpeg-static@^5.3.0
fluent-ffmpeg@^2.1.3
koa@^3.1.1
koa-bodyparser@^4.4.1
livekit-server-sdk@^2.15.4
mammoth@^1.11.0
mediabunny@^1.40.1
music-metadata@^11.11.2
pdf-parse@^2.4.5
pdf-to-img@^5.0.0
pptxgenjs@^4.0.1
sharp@^0.34.5

obfuscation 1

dynamic require()/import() package/dist/cli/commands/serve.js :504 const { createServer: createNewServer, registerAllRoutes: registerNewRoutes, } = await import(`../../lib/server/index.js?t=${timestamp}`);