registry / @tuned-tensor/local / 0.2.0

@tuned-tensor/local@0.2.0

TT Local: tuning tensors locally on hardware you control.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 170 KB of source, external domains: openrouter.ai

Source & flagged code

2 flagged

dist/openrouter.jsView file

Lines 1-37javascript

1export class OpenRouterHttpError extends Error {

2 statusCode;

3 constructor(message, statusCode) {

4 super(message);

5 this.statusCode = statusCode;

6 this.name = "OpenRouterHttpError";

7 }

9export function isRetryableOpenRouterError(error) {

10 if (error instanceof OpenRouterHttpError) {

11 return [408, 409, 425, 429, 500, 502, 503, 504].includes(error.statusCode);

12 }

13 if (!(error instanceof Error))

14 return false;

15 return error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError";

16}

17export async function openRouterChat(messages, options) {

18 const apiKey = process.env[options.apiKeyEnv];

19 if (!apiKey) {

20 throw new Error(`${options.apiKeyEnv} is not set`);

21 }

22 const controller = new AbortController();

23 const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 120_000);

24 try {

25 const response = await fetch("https://openrouter.ai/api/v1/chat/completions", {

26 method: "POST",

27 signal: controller.signal,

28 headers: {

29 "Content-Type": "application/json",

30 Authorization: `Bearer ${apiKey}`,

31 ...(options.siteUrl ? { "HTTP-Referer": options.siteUrl } : {}),

32 ...(options.appName ? { "X-Title": options.appName } : {}),

33 },

34 body: JSON.stringify({

35 model: options.model,

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/openrouter.jsView on unpkg · L17

36 messages,

37 temperature: options.temperature ?? 0,

training/sft-local/src/train.pyView file

•path = training/sft-local/src/train.py kind = build_helper sizeBytes = 14738 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

training/sft-local/src/train.pyView on unpkg

Source & flagged code

2 flagged · loading source

dist/openrouter.jsView file

17export async function openRouterChat(messages, options) { L18: const apiKey = process.env[options.apiKeyEnv]; L19: if (!apiKey) { ... L24: try { L25: const response = await fetch("https://openrouter.ai/api/v1/chat/completions", { L26: method: "POST", ... L33: }, L34: body: JSON.stringify({ L35: model: options.model, ... L44: if (!response.ok) { L45: const text = await response.text().catch(() => ""); L46: throw new OpenRouterHttpError(`OpenRouter request failed (${response.status}): ${text.slice(0, 500)}`, response.status);

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/openrouter.jsView on unpkg · L17

training/sft-local/src/train.pyView file

•path = training/sft-local/src/train.py kind = build_helper sizeBytes = 14738 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

training/sft-local/src/train.pyView on unpkg

Findings

1 High3 Medium3 Low

HighCredential Exfiltrationdist/openrouter.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertraining/sft-local/src/train.py

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

dist/openrouter.jsView file

Lines 1-37javascript

1export class OpenRouterHttpError extends Error {

2 statusCode;

3 constructor(message, statusCode) {

4 super(message);

5 this.statusCode = statusCode;

6 this.name = "OpenRouterHttpError";

7 }

9export function isRetryableOpenRouterError(error) {

10 if (error instanceof OpenRouterHttpError) {

11 return [408, 409, 425, 429, 500, 502, 503, 504].includes(error.statusCode);

12 }

13 if (!(error instanceof Error))

14 return false;

15 return error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError";

16}

17export async function openRouterChat(messages, options) {

18 const apiKey = process.env[options.apiKeyEnv];

19 if (!apiKey) {

20 throw new Error(`${options.apiKeyEnv} is not set`);

21 }

22 const controller = new AbortController();

23 const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 120_000);

24 try {

25 const response = await fetch("https://openrouter.ai/api/v1/chat/completions", {

26 method: "POST",

27 signal: controller.signal,

28 headers: {

29 "Content-Type": "application/json",

30 Authorization: `Bearer ${apiKey}`,

31 ...(options.siteUrl ? { "HTTP-Referer": options.siteUrl } : {}),

32 ...(options.appName ? { "X-Title": options.appName } : {}),

33 },

34 body: JSON.stringify({

35 model: options.model,

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/openrouter.jsView on unpkg · L17

36 messages,

37 temperature: options.temperature ?? 0,

training/sft-local/src/train.pyView file

•path = training/sft-local/src/train.py kind = build_helper sizeBytes = 14738 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

training/sft-local/src/train.pyView on unpkg