Loading npm security reports…
ZeroGPU device-side SLM runtime SDK for browsers and Chrome (MV3) extensions
The browser entrypoint accepts a runtime trackingScript URL from a task and loads it as executable JavaScript in the host page. The URL is only constrained to HTTPS, not to an approved host.
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/assets/transformers.min.jsView on unpkg · L27A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assets/transformers.min.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/assets/transformers.min.jsView on unpkg · L33Package source references dynamic require/import behavior.
dist/extension/zerogpu-offscreen.jsView on unpkg · L1This report applies to @zerogpu/browser-extension-sdk@0.4.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/assets/transformers.min.jsView on unpkg · L27A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/assets/transformers.min.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
dist/assets/transformers.min.jsView on unpkg · L33Package source references dynamic require/import behavior.
dist/extension/zerogpu-offscreen.jsView on unpkg · L1