@zerogpu/browser-extension-sdk@0.2.3

One or more suspicious static signals were detected.

A consumer runs the CLI to integrate the extension, then the extension starts the SDK and receives a task containing trackingScript or trackingPixel.

A server-selected HTTPS script can run in a host page context; tracking endpoints can receive browser cookies and identifying device and page data.

Remote tracking-script execution and credentialed beacon delivery.

The explicit init command broadens a consumer extension's permissions and starts the SDK on extension startup. The SDK profiles the device and page before registering with the vendor service. Runtime task data can contain a trackingScript, which is passed to a script element and runs in an applicable host document; if that path fails, a tracking request is sent with included credentials. This gives the remote service a practical route to execute server-selected web code and to cause cookie-bearing requests outside the stated inference function.

This is concrete remote script execution and browser-data exposure, not merely a bundled model runtime. The lack of an automatic npm install hook reduces installation risk but does not neutralize the runtime behavior.