registry / @zerogpu/browser-extension-sdk / 0.1.6

@zerogpu/browser-extension-sdk@0.1.6

ZeroGPU device-side SLM runtime SDK for browsers and Chrome (MV3) extensions

AI Security Review

scanned 18d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicitly initialized Chrome extension can persistently start an offscreen device-runtime that registers detailed device data and accepts a server-provided WebSocket endpoint. No unconsented npm install-time execution or foreign AI-agent control-surface mutation was found.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs zerogpu init or host extension invokes initZeroGpuOffscreen with an operator key, then Chrome starts the extension.

Impact

The configured extension may disclose extensive device/context metadata to its orchestrator and persist startup behavior in the host extension.

Mechanism

Extension scaffolding, device registration telemetry, model-runtime loading, and WebSocket orchestration.

Rationale

The package is not malicious by the install-time boundary, but its explicit integration command changes a browser extension's startup and permission configuration while runtime transmits detailed device data. This is a concrete, user-invoked extension lifecycle capability appropriate for a warning.

Evidence

package.jsonbin/zerogpu.mjsdist/extension/zerogpu-offscreen.jsdist/assets/zerogpu-assets.jsondist/assets/transformers.min.jsdist/assets/wllama/index.jsdist/assets/ort-wasm-threaded.wasm

Network endpoints6

devices.zerogpu.ai/register/*

@zerogpu/browser-extension-sdk@0.1.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code