registry / @easbot/local-model-sdk / 0.3.4

@easbot/local-model-sdk@0.3.4

Complete local model SDK for EASBot - Transformers.js + ONNX implementation supporting both Language Model (text generation) and Embedding (text embedding) with full AI SDK v2 compatibility

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 100 KB of source

Source & flagged code

1 flagged

dist/index.mjsView file

Lines 1-21javascript

1import*as J from'os';import*as _ from'path';import ___default from'path';import*as b from'fs';import {Log}from'@easbot/utils';import {streamText}from'ai';var te=Object.defineProperty;var ne=(f,e,t)=>e in f?te(f,e,{enumerable:true,configurable:true,writable:true,value:t}):f[e]=t;var c=(f,e,t)=>ne(f,typeof e!="symbol"?e+"":e,t);var w=(d=>(d.MODEL_NOT_FOUND="MODEL_NOT_FOUND",d.MODEL_LOAD_ERROR="MODEL_LOAD_ERROR",d.MODEL_NOT_INITIALIZED="MODEL_NOT_INITIALIZED",d.GENERATION_ERROR="GENERATION_ERROR",d.EMBEDDING_ERROR="EMBEDDING_ERROR",d.INVALID_INPUT="INVALID_INPUT",d.UNSUPPORTED_FEATURE="UNSUPPORTE ...

2`,r=e.lastIndexOf(n);if(r!==-1){let u=e.slice(r+n.length);return u=u.replace(/<\|im_end\|>$/g,""),u.trim()}let o=`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.mjsView on unpkg · L1

3assistant

4`,a=e.lastIndexOf(o);if(a!==-1)return e.slice(a+o.length).trim();let g=`assistant

5`,i=e.lastIndexOf(g);return i!==-1?e.slice(i+g.length).trim():(e.startsWith(t)?e.slice(t.length):e).trim()}async generate(e,t){let r=x[this.config.modelId]?.defaultSettings||{temperature:.7,topP:.9,topK:40,maxTokens:2048,repetitionPenalty:1.1,stopSequences:[]},o={temperature:t.temperature??r.temperature,topP:t.topP??r.topP,topK:t.topK??r.topK,maxTokens:t.maxTokens??r.maxTokens,repetitionPenalty:t.repetitionPenalty??r.repetitionPenalty,stopSequences:t.stopSequences??r.stopSequences,abortSignal:t.abortSignal};if(this.config.modelType!=="language")throw new s("\u5F53\u524D\u6A21\u578B\u4E0D\u652F ...

6`)),n.role){case "system":t.push(`<|im_start|>system

7${r}<|im_end|>`);break;case "user":t.push(`<|im_start|>user

8${r}<|im_end|>`);break;case "assistant":t.push(`<|im_start|>assistant

9${r}<|im_end|>`);break;default:throw new s(`\u4E0D\u652F\u6301\u7684\u6D88\u606F\u89D2\u8272: ${n.role}`,"UNSUPPORTED_FEATURE")}}return t.push(`<|im_start|>assistant

10`),t.join(`

11`)}async doGenerate(e){M.validateMessages(e.prompt);let t=this.convertToQwenFormat(e.prompt),n={temperature:e.temperature??this.modelConfig.defaultSettings.temperature,topP:e.topP??this.modelConfig.defaultSettings.topP,topK:e.topK??this.modelConfig.defaultSettings.topK,maxTokens:e.maxOutputTokens??this.modelConfig.defaultSettings.maxTokens,repetitionPenalty:this.modelConfig.defaultSettings.repetitionPenalty,stopSequences:this.modelConfig.defaultSettings.stopSequences,abortSignal:e.abortSignal};M.validateGenerateOptions(n),this.engine.isReady()||await this

12`),n.join(`

13`)}static buildSystemPrompt(e){return e&&e.length>0?`<|im_start|>system

14Environment: ipython

16You have access to the following functions:

18${f.formatToolsDefinition(e)}

20FUNCTION CALLING INSTRUCTIONS:

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/index.mjsView file

1package = @easbot/local-model-sdk; repositoryIdentity = easbot; dependency = @huggingface/transformers L1: import*as J from'os';import*as _ from'path';import ___default from'path';import*as b from'fs';import {Log}from'@easbot/utils';import {streamText}from'ai';var te=Object.defineProper... L2: `,r=e.lastIndexOf(n);if(r!==-1){let u=e.slice(r+n.length);return u=u.replace(/<\|im_end\|>$/g,""),u.trim()}let o=`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.mjsView on unpkg · L1

Findings

1 High2 Medium2 Low

HighCopied Package Dependency Bridgedist/index.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

1 flagged

dist/index.mjsView file

Lines 1-21javascript

2`,r=e.lastIndexOf(n);if(r!==-1){let u=e.slice(r+n.length);return u=u.replace(/<\|im_end\|>$/g,""),u.trim()}let o=`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.mjsView on unpkg · L1

3assistant

4`,a=e.lastIndexOf(o);if(a!==-1)return e.slice(a+o.length).trim();let g=`assistant

6`)),n.role){case "system":t.push(`<|im_start|>system

7${r}<|im_end|>`);break;case "user":t.push(`<|im_start|>user

8${r}<|im_end|>`);break;case "assistant":t.push(`<|im_start|>assistant

9${r}<|im_end|>`);break;default:throw new s(`\u4E0D\u652F\u6301\u7684\u6D88\u606F\u89D2\u8272: ${n.role}`,"UNSUPPORTED_FEATURE")}}return t.push(`<|im_start|>assistant

10`),t.join(`

12`),n.join(`

13`)}static buildSystemPrompt(e){return e&&e.length>0?`<|im_start|>system

14Environment: ipython

16You have access to the following functions:

18${f.formatToolsDefinition(e)}

20FUNCTION CALLING INSTRUCTIONS:

Long lines were clipped for display.