@zerogpu/browser-extension-sdk@0.2.1: Suspicious npm security | LPM Firewall

Loading npm security reports…

@zerogpu/browser-extension-sdk@0.2.1: Suspicious npm security | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/assets/transformers.min.jsView file

27!*** ./node_modules/onnxruntime-common/dist/lib/tensor-impl.js ***! L28: \*****************************************************************/(e,t,n)=>{n.r(t),n.d(t,{Tensor:()=>a});const r="undefined"!=typeof BigInt64Array&&"function"==typeof BigInt64Arra... L29: /*!************************************************************!*\ ... L33: !*** ./node_modules/onnxruntime-web/dist/ort-web.min.js ***! L34: \**********************************************************/(module,__unused_webpack_exports,__webpack_require__)=>{var e;self,e=__WEBPACK_EXTERNAL_MODULE__1670__=>(()=>{var __webp... L35: /*!**********************************!*\ ... L66: !*** ./src/env.js ***! L67: \********************/(e,t,n)=>{n.r(t),n.d(t,{env:()=>g});var r=n(/*! fs */"?569f"),o=n(/*! path */"?3f59"),i=n(/*! url */"?

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/assets/transformers.min.jsView on unpkg · L27

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/assets/transformers.min.jsView on unpkg

33!*** ./node_modules/onnxruntime-web/dist/ort-web.min.js ***! L34: \**********************************************************/(module,__unused_webpack_exports,__webpack_require__)=>{var e;self,e=__WEBPACK_EXTERNAL_MODULE__1670__=>(()=>{var __webp... L35: /*!**********************************!*\

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/transformers.min.jsView on unpkg · L33

dist/extension/zerogpu-offscreen.jsView file

3774const importStart = performance.now(); L3775: const transformersModule = await import(/* @vite-ignore */ runtimeUrl); L3776: const pipeline = transformersModule?.pipeline;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extension/zerogpu-offscreen.jsView on unpkg · L3774

dist/assets/ort-wasm-threaded.wasmView file

•path = dist/assets/ort-wasm-threaded.wasm kind = wasm_module sizeBytes = 9149637 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/ort-wasm-threaded.wasmView on unpkg

Source & flagged code

5 flagged

dist/assets/transformers.min.jsView file

27!*** ./node_modules/onnxruntime-common/dist/lib/tensor-impl.js ***! L28: \*****************************************************************/(e,t,n)=>{n.r(t),n.d(t,{Tensor:()=>a});const r="undefined"!=typeof BigInt64Array&&"function"==typeof BigInt64Arra... L29: /*!************************************************************!*\ ... L33: !*** ./node_modules/onnxruntime-web/dist/ort-web.min.js ***! L34: \**********************************************************/(module,__unused_webpack_exports,__webpack_require__)=>{var e;self,e=__WEBPACK_EXTERNAL_MODULE__1670__=>(()=>{var __webp... L35: /*!**********************************!*\ ... L66: !*** ./src/env.js ***! L67: \********************/(e,t,n)=>{n.r(t),n.d(t,{env:()=>g});var r=n(/*! fs */"?569f"),o=n(/*! path */"?3f59"),i=n(/*! url */"?

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/assets/transformers.min.jsView on unpkg · L27

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/assets/transformers.min.jsView on unpkg

33!*** ./node_modules/onnxruntime-web/dist/ort-web.min.js ***! L34: \**********************************************************/(module,__unused_webpack_exports,__webpack_require__)=>{var e;self,e=__WEBPACK_EXTERNAL_MODULE__1670__=>(()=>{var __webp... L35: /*!**********************************!*\

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/transformers.min.jsView on unpkg · L33

dist/extension/zerogpu-offscreen.jsView file

Lines 3754-3794javascript

3754};

3755

3756const TRANSFORMERS_CDN = 'https://cdn.jsdelivr.net/npm/@xenova/transformers@2.17.2/dist/transformers.min.js';

3757let transformersRuntimePromise = null;

3758const serializeError$5 =

dist/assets/ort-wasm-threaded.wasmView file

•path = dist/assets/ort-wasm-threaded.wasm kind = wasm_module sizeBytes = 9149637 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/ort-wasm-threaded.wasmView on unpkg