Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@camstack/addon-model-studio@1.0.28: Clean npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 14 low-signal pattern(s) reviewed.

View on npm All versions

registry / @camstack/addon-model-studio / 1.0.28

@camstack/addon-model-studio@1.0.28

Custom detection model registry, conversion & distribution for CamStack

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Explicit model-conversion actions download a requested ONNX file and run the bundled Python converter locally.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit Model Studio `convertModel` action

Impact

Writes conversion jobs and validated model artifacts in configured runtime data directories; no unconsented install-time action or exfiltration found.

Mechanism

Requested-model download and local Python conversion

Rationale

The package is a CamStack model registry/conversion addon with no lifecycle execution. Its network, environment-token, filesystem, and subprocess use are directly tied to explicit model conversion and do not form a concrete malicious chain.

Evidence

package.jsondist/index.jsdist/model-studio.addon.mjspython/convert.pypython/convert_lib.pypython/__tests__/test_convert_lib.pypython/requirements.txt

Network endpoints1

huggingface.co

Decision evidence

public snapshot

AI called this at 97.0% confidence with false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Clean

as Benign

low

Evidence for block

Evidence against

`package.json` has no preinstall/install/postinstall hooks.
`dist/index.js` only exports the Model Studio addon.
Conversion is invoked by `convertModel`, not at install or import.
`dist/model-studio.addon.mjs` sends HF_TOKEN only to `huggingface.co`.
`python/convert.py` performs local ONNX-to-OpenVINO/CoreML conversion.
No credential harvesting, persistence, destructive actions, or hidden binaries found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

WildcardDependency

scanned 27 file(s), 2.44 MB of source, external domains: github.com, json-schema.org, konvajs.github.io, konvajs.org, module-federation.io, react.dev, www.w3.org

Source & flagged code

5 flagged · loading source

dist/model-studio.addon.mjsView file

149try { L150: new Function(""); L151: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/model-studio.addon.mjsView on unpkg · L149

dist/index.jsView file

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" }); L2: const require_model_studio_addon = require("./model-studio.addon.js"); L3: exports.ModelStudioAddon = require_model_studio_addon.ModelStudioAddon;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

python/convert_lib.pyView file

•path = python/convert_lib.py kind = build_helper sizeBytes = 4549 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/convert_lib.pyView on unpkg

python/__tests__/test_convert_lib.pyView file

•path = python/__tests__/test_convert_lib.py kind = payload_in_excluded_dir sizeBytes = 1203 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/__tests__/test_convert_lib.pyView on unpkg

dist/_stub.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @camstack/addon-model-studio@1.0.24 matchedIdentity = npm:[redacted]:1.0.24 similarity = 0.926 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/_stub.jsView on unpkg

Findings

2 High6 Medium6 Low

HighPayload In Excluded Dirpython/__tests__/test_convert_lib.py

HighPrevious Version Dangerous Deltadist/_stub.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperpython/convert_lib.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/model-studio.addon.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

97%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Maintainersapocaliss92

Version1.1.1

PublishedJul 18, 2026

LicenseMIT

Dependencies3

Integrityverified

Package size638 KB

Files33

Keywordscamstackaddoncamstack-addonmodeldetectionregistry

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.mjstypes → ./dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact2.56 MB · 33 files1 signature(s)

Install lifecycleNo install hooks · other: build, build:page, build:server, dev:page +3

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellHighEntropyStringsMinifiedTelemetryUrlStringsWildcardDependency

LPM CLI

Source & flagged code

5 flagged

dist/model-studio.addon.mjsView file

149try { L150: new Function(""); L151: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/model-studio.addon.mjsView on unpkg · L149

dist/index.jsView file

Lines 1-5javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_model_studio_addon = require("./model-studio.addon.js");

3exports.ModelStudioAddon = require_model_studio_addon.ModelStudioAddon;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

4exports.customActions = require_model_studio_addon.modelStudioActions;

5

python/convert_lib.pyView file

•path = python/convert_lib.py kind = build_helper sizeBytes = 4549 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/convert_lib.pyView on unpkg

python/__tests__/test_convert_lib.pyView file

•path = python/__tests__/test_convert_lib.py kind = payload_in_excluded_dir sizeBytes = 1203 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/__tests__/test_convert_lib.pyView on unpkg

dist/_stub.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @camstack/addon-model-studio@1.0.24 matchedIdentity = npm:[redacted]:1.0.24 similarity = 0.926 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/_stub.jsView on unpkg