registry / @easbot/local-model-sdk / 0.3.4

@easbot/local-model-sdk@0.3.4

Complete local model SDK for EASBot - Transformers.js + ONNX implementation supporting both Language Model (text generation) and Embedding (text embedding) with full AI SDK v2 compatibility

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 100 KB of source

Source & flagged code

1 flagged

dist/index.mjsView file

Lines 1-21javascript

1import*as J from'os';import*as _ from'path';import ___default from'path';import*as b from'fs';import {Log}from'@easbot/utils';import {streamText}from'ai';var te

Source & flagged code

1 flagged · loading source

dist/index.mjsView file

1package = @easbot/local-model-sdk; repositoryIdentity = easbot; dependency = @huggingface/transformers L1: import*as J from'os';import*as _ from'path';import ___default from'path';import*as b from'fs';import {Log}from'@easbot/utils';import {streamText}from'ai';var te=Object.defineProper... L2: `,r=e.lastIndexOf(n);if(r!==-1){let u=e.slice(r+n.length);return u=u.replace(/<\|im_end\|>$/g,""),u.trim()}let o=`

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.mjsView on unpkg · L1

Findings

1 High2 Medium2 Low

HighCopied Package Dependency Bridgedist/index.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

5`,i=e.lastIndexOf(g);return i!==-1?e.slice(i+g.length).trim():(e.startsWith(t)?e.slice(t.length):e).trim()}async generate(e,t){let r=x[this.config.modelId]?.defaultSettings||{temperature:.7,topP:.9,topK:40,maxTokens:2048,repetitionPenalty:1.1,stopSequences:[]},o={temperature:t.temperature??r.temperature,topP:t.topP??r.topP,topK:t.topK??r.topK,maxTokens:t.maxTokens??r.maxTokens,repetitionPenalty:t.repetitionPenalty??r.repetitionPenalty,stopSequences:t.stopSequences??r.stopSequences,abortSignal:t.abortSignal};if(this.config.modelType!=="language")throw new s("\u5F53\u524D\u6A21\u578B\u4E0D\u652F ...

11`)}async doGenerate(e){M.validateMessages(e.prompt);let t=this.convertToQwenFormat(e.prompt),n={temperature:e.temperature??this.modelConfig.defaultSettings.temperature,topP:e.topP??this.modelConfig.defaultSettings.topP,topK:e.topK??this.modelConfig.defaultSettings.topK,maxTokens:e.maxOutputTokens??this.modelConfig.defaultSettings.maxTokens,repetitionPenalty:this.modelConfig.defaultSettings.repetitionPenalty,stopSequences:this.modelConfig.defaultSettings.stopSequences,abortSignal:e.abortSignal};M.validateGenerateOptions(n),this.engine.isReady()||await this.engine.initialize();let r=await this.e ...