@zerogpu/worker@0.4.0
ZeroGPU Worker — join the ZeroGPU network from a Docker container or any Node.js host (servers, macOS desktop apps, developer laptops), and serve inference locally.
AI Security Review
scanned 4d ago · by lpm-firewall-aiNo malicious exfiltration or unrelated attack behavior was identified. However, runtime telemetry is sent automatically without disclosure or an apparent opt-out, so this warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Worker startup creates the event client; it flushes periodically and also flushes on some events.
Impact
ZeroGPU receives worker identifiers and operational error details. The reviewed code does not show unrelated credential or project-data collection.
Mechanism
The client posts event batches with device/session fields and the operator key to the configured registry’s /events endpoint. Events can contain clipped error messages and model/task metadata.
AI rationale
No malicious exfiltration or unrelated attack behavior was identified. However, runtime telemetry is sent automatically without disclosure or an apparent opt-out, so this warrants a warning.
Evidence
dist/index.jsconfigured ZG_DATA_DIR/event-buffer.json
Network endpoints3
devices.zerogpu.ai/eventsstaging.devices.zerogpu.ai/eventsdev.devices.zerogpu.ai/events
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Starting the worker creates an event client that flushes telemetry on a recurring timer.
- Telemetry sends device and session identifiers plus events; event records can include clipped error messages and model/task metadata.
- The telemetry endpoint uses the worker’s configured ZeroGPU registry host. The README describes joining that fleet with the operator key.
Evidence against
- The package describes a worker that registers with ZeroGPU and serves local inference, matching its stated purpose.
- The operator key is sent to the ZeroGPU registry for device registration; no source evidence shows it being sent to an unrelated host.
- No install hook or unrelated credential collection was identified.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @zerogpu/worker@0.1.0
matchedIdentity = npm:QHplcm9ncHUvd29ya2Vy:0.1.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg2`):i.write(`${n}
L3: `)}function y(s){return{debug:(e,t)=>We("debug",s,e,t),info:(e,t)=>We("info",s,e,t),warn:(e,t)=>We("warn",s,e,t),error:(e,t)=>We("error",s,e,t)}}var As=y("benchmark");function Es()...
L4: ${i??""}`))})})}var ce=new Set,Xr=!1;function me(){let s=[];for(let e of ce)typeof e.pid=="number"&&s.push({pid:e.pid,binary:e.spawnfile});return s}function Mi(){Xr||(Xr=!0,process...
High
2`):i.write(`${n}
L3: `)}function y(s){return{debug:(e,t)=>We("debug",s,e,t),info:(e,t)=>We("info",s,e,t),warn:(e,t)=>We("warn",s,e,t),error:(e,t)=>We("error",s,e,t)}}var As=y("benchmark");function Es()...
L4: ${i??""}`))})})}var ce=new Set,Xr=!1;function me(){let s=[];for(let e of ce)typeof e.pid=="number"&&s.push({pid:e.pid,binary:e.spawnfile});return s}function Mi(){Xr||(Xr=!0,process...
Findings
1 Critical4 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.js
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @zerogpu/worker@0.4.0.
See all versions of @zerogpu/worker for other recorded verdicts.
- Review the evidence and your use of @zerogpu/worker@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.