Loading npm security reports…
Custom detection model registry, conversion & distribution for CamStack
A caller able to invoke the model-conversion action can select an arbitrary download URL. If a Hugging Face environment token is configured, a URL containing `huggingface.co` can cause that token to be sent to an attacker-controlled host.
Package source references a known benign dynamic code generation pattern.
dist/model-studio.addon.mjsView on unpkg · L149Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
python/convert_lib.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
python/__tests__/test_convert_lib.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/_stub.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/model-studio.addon.mjsView on unpkg · L149Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
python/convert_lib.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
python/__tests__/test_convert_lib.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/_stub.jsView on unpkg