registry / @realtimex/node-llama-cpp / 0.253.0

@realtimex/node-llama-cpp@0.253.0

Run AI models locally on your machine with node.js bindings for llama.cpp. Enforce a JSON schema on the model output on the generation level

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 276 file(s), 1.61 MB of source, external domains: api.github.com, github.com, hf.co, huggingface.co, node-llama-cpp.withcat.ai, registry.npmjs.org

Source & flagged code

3 flagged

package.jsonView file

Lines 35-75json

35 "default": "./dist/index.js"

36 },

37 "./commands": {

38 "import": "./dist/commands.js",

39 "node": "./dist/commands.js",

40 "types": "./dist/commands.d.ts",

41 "default": "./dist/commands.js"

42 },

43 "./commands.js": {

44 "import": "./dist/commands.js",

45 "node": "./dist/commands.js",

46 "types": "./dist/commands.d.ts",

47 "default": "./dist/commands.js"

48 }

49 },

50 "engines": {

51 "node": ">=20.0.0"

52 },

53 "scripts": {

54 "prepare": "node --experimental-require-module -e \"process.env.CI !== 'true' && console.log(require('husky').default())\"",

55 "postinstall": "node ./dist/cli/cli.js postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "postversion": "vite-node scripts/postVersion.ts",

57 "prebuild": "rimraf ./dist ./tsconfig.tsbuildinfo",

58 "build": "tsc --build tsconfig.json --force && npm run build:packTemplates",

59 "build:packTemplates": "vite-node scripts/packTemplates.ts",

60 "addPostinstallScript": "npm pkg set scripts.postinstall=\"node ./dist/cli/cli.js postinstall\"",

61 "prewatch": "rimraf ./dist ./tsconfig.tsbuildinfo",

62 "watch": "tsc --build tsconfig.json --watch --force",

63 "cmake-js-llama": "cd llama && cmake-js",

64 "test": "npm run test:typescript && npm run lint:eslint && npm run test:vitest",

65 "test:vitest": "vitest run ./test",

66 "test:standalone": "vitest run ./test/standalone",

67 "test:standalone:interactive": "vitest watch ./test/standalone",

68 "test:modelDependent": "vitest run ./test/modelDependent",

69 "test:modelDependent:interactive": "vitest watch ./test/modelDependent",

70 "test:typescript": "tsc --noEmit --project tsconfig.json",

71 "lint": "npm run lint:eslint",

72 "lint:eslint": "eslint --report-unused-disable-directives .",

73 "format": "npm run lint:eslint -- --fix",

74 "dev:setup:downloadAllTestModels": "vite-node test/utils/scripts/downloadAllTestModels.ts",

75 "dev:setup": "npm run build && node ./dist/cli/cli.js source download --noUsageExample && npm run docs:generateTypedoc && npm run dev:setup:downloadAllTestModels",

dist/bindings/utils/testBindingBinary.jsView file

Lines 1-29javascript

1import { fork } from "node:child_process";

2import { fileURLToPath } from "url";

3import { createRequire } from "module";

4import path from "path";

5import { getConsoleLogPrefix } from "../../utils/getConsoleLogPrefix.js";

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/cli/cli.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/cli/cli.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bindings/utils/testBindingBinary.jsView file

9import { getPlatform } from "./getPlatform.js"; L10: const require = createRequire(import.meta.url); L11: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bindings/utils/testBindingBinary.jsView on unpkg · L9

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/bindings/utils/testBindingBinary.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 35-75json

35 "default": "./dist/index.js"

36 },

37 "./commands": {

38 "import": "./dist/commands.js",

39 "node": "./dist/commands.js",

40 "types": "./dist/commands.d.ts",

41 "default": "./dist/commands.js"

42 },

43 "./commands.js": {

44 "import": "./dist/commands.js",

45 "node": "./dist/commands.js",

46 "types": "./dist/commands.d.ts",

47 "default": "./dist/commands.js"

48 }

49 },

50 "engines": {

51 "node": ">=20.0.0"

52 },

53 "scripts": {

54 "prepare": "node --experimental-require-module -e \"process.env.CI !== 'true' && console.log(require('husky').default())\"",

55 "postinstall": "node ./dist/cli/cli.js postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L55

56 "postversion": "vite-node scripts/postVersion.ts",

57 "prebuild": "rimraf ./dist ./tsconfig.tsbuildinfo",

58 "build": "tsc --build tsconfig.json --force && npm run build:packTemplates",

59 "build:packTemplates": "vite-node scripts/packTemplates.ts",

60 "addPostinstallScript": "npm pkg set scripts.postinstall=\"node ./dist/cli/cli.js postinstall\"",

61 "prewatch": "rimraf ./dist ./tsconfig.tsbuildinfo",

62 "watch": "tsc --build tsconfig.json --watch --force",

63 "cmake-js-llama": "cd llama && cmake-js",

64 "test": "npm run test:typescript && npm run lint:eslint && npm run test:vitest",

65 "test:vitest": "vitest run ./test",

66 "test:standalone": "vitest run ./test/standalone",

67 "test:standalone:interactive": "vitest watch ./test/standalone",

68 "test:modelDependent": "vitest run ./test/modelDependent",

69 "test:modelDependent:interactive": "vitest watch ./test/modelDependent",

70 "test:typescript": "tsc --noEmit --project tsconfig.json",

71 "lint": "npm run lint:eslint",

72 "lint:eslint": "eslint --report-unused-disable-directives .",

73 "format": "npm run lint:eslint -- --fix",

74 "dev:setup:downloadAllTestModels": "vite-node test/utils/scripts/downloadAllTestModels.ts",

75 "dev:setup": "npm run build && node ./dist/cli/cli.js source download --noUsageExample && npm run docs:generateTypedoc && npm run dev:setup:downloadAllTestModels",

dist/bindings/utils/testBindingBinary.jsView file

Lines 1-29javascript

1import { fork } from "node:child_process";

2import { fileURLToPath } from "url";

3import { createRequire } from "module";

4import path from "path";

5import { getConsoleLogPrefix } from "../../utils/getConsoleLogPrefix.js";