Loading npm security reports…
Custom detection model registry, conversion & distribution for CamStack
An admin-triggered model conversion can download a model from a caller-controlled URL. The Hugging Face token host check is substring-based, so an attacker-controlled lookalike URL can receive the bearer token.
Package source references a known benign dynamic code generation pattern.
dist/model-studio.addon.mjsView on unpkg · L149Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
python/convert_lib.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
python/__tests__/test_convert_lib.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/_stub.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/model-studio.addon.mjsView on unpkg · L149Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L1Package ships non-JavaScript build or shell helper files.
python/convert_lib.pyView on unpkgPackage hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
python/__tests__/test_convert_lib.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/_stub.jsView on unpkg