tensorlake@0.5.133: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

tensorlake@0.5.133: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/index.jsView file

6649init_esm_shims(); L6650: import { execFile } from "child_process"; L6651: import { accessSync, constants } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6649

383// The bundled worker needs no application loaders or telemetry preloads. L384: // NODE_OPTIONS is parsed independently of execArgv by Node. L385: execArgv: [],

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L383

49SDK_VERSION = "0.5.133"; API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai"; API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0; NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default"; SANDBOX_PROXY_URL = process.env.T

Low

Ai Review Evidence

The main SDK reads its API configuration from TensorLake-specific environment variables and defaults to the TensorLake API.

dist/index.jsView on unpkg · L49

bin/tensorlake-deploy.cjsView file

2L3: const { runPythonModule } = require("../lib/runtime.cjs"); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tensorlake-deploy.cjsView on unpkg · L2

dist/applications/index.cjsView file

52Cross-file remote execution chain: dist/applications/index.cjs spawns dist/function-agent/main.js; helper contains network access plus dynamic code execution. L52: SDK_VERSION = "0.5.133"; L53: API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai"; L54: API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0; ... L144: try { L145: const payload = JSON.parse(message); L146: if (payload && typeof payload === "object" && !Array.isArray(payload)) { ... L347: if (handle) this.register(handle, worker); L348: this.send(worker, { L349: type: "call", ... L374: // The bundled worker needs no application loaders or telemetry preloads. L375: // NODE_OPTIONS is parsed independently of execArgv by Node. L376: execArgv: [],

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/applications/index.cjsView on unpkg · L52

package.jsonView file

46"scripts": { "build:sdk": "tsup", "build:runtime": "node ./scripts/build-function-executor-capsule.mjs && node ./scripts/build-typescript-function-runner-capsule.mjs && node ./scripts/check-package-compatibility.mjs", "build:native": "node ./scripts/build-native.mjs", "build": "npm run build:sdk && npm run build:native && npm run build:runtime", "check:proto": "node ./scripts/check-function-executor-proto.mjs", "typecheck": "tsc --noEmit", "test": "vitest run --exclude tests/integration.test.ts", "test:function-executor": "vitest run tests/function-executor.te

Low

Suspicious Lifecycle Evidence

The manifest defines build and test scripts and no install lifecycle hook.

package.jsonView on unpkg · L46

Source & flagged code

6 flagged

dist/index.jsView file

Lines 29-69javascript

29 // "default" to the CommonJS "module.exports" for node compatibility.

30 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

31 mod

32));

33

34// node_modules/tsup/assets/esm_shims.js

35import path from "path";

36import { fileURLToPath } from "url";

37var init_esm_shims = __esm({

38 "node_modules/tsup/assets/esm_shims.js"() {

39 "use strict";

40 }

41});

42

43// src/defaults.ts

44var SDK_VERSION, API_URL, API_KEY, NAMESPACE, SANDBOX_PROXY_URL, DEFAULT_HTTP_TIMEOUT_MS, MAX_RETRIES, RETRY_BACKOFF_MS;

45var init_defaults = __esm({

46 "src/defaults.ts"() {

47 "use strict";

48 init_esm_shims();

49 SDK_VERSION = "0.5.133";

50 API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";

51 API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;

52 NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";

53 SANDBOX_PROXY_URL = process.env.TENSORLAKE_SANDBOX_PROXY_URL ?? "https://sandbox.tensorlake.ai";

Low

Ai Review Evidence

The main SDK reads its API configuration from TensorLake-specific environment variables and defaults to the TensorLake API.

dist/index.jsView on unpkg · L49

54 DEFAULT_HTTP_TIMEOUT_MS = 3e5;

55 MAX_RETRIES = 3;

56 RETRY_BACKOFF_MS = 500;

57 }

58});

59

60// src/errors.ts

61function formatErrorDetails(errorDetails) {

62 if (errorDetails == null) return void 0;

63 if (typeof errorDetails === "string") {

64 const detail = errorDetails.trim();

65 return detail || void 0;

66 }

67 if (Array.isArray(errorDetails)) {

68 const parts = errorDetails.map((item) => formatErrorDetails(item)).filter((item) => Boolean(item));

69 return parts.length > 0 ? parts.join("; ") : JSON.stringify(errorDetails);

Lines 363-403javascript

363 stream: !!emit

364 });

365 } catch (error) {

366 this.pending.delete(id);

367 this.unrefIfIdle();

368 reject(error);

369 }

Lines 6629-6669javascript

6629});

6630

6631// src/index.ts

6632init_esm_shims();

6633init_client();

6634init_sandbox();

6635init_sandbox();

6636init_desktop();

6637init_tunnel();

6638init_cloud_client();

6639

bin/tensorlake-deploy.cjsView file

Lines 1-9javascript

1#!/usr/bin/env node

2

3const { runPythonModule } = require("../lib/runtime.cjs");

4

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tensorlake-deploy.cjsView on unpkg · L2

5runPythonModule(

6 "tensorlake.cli.deploy"

dist/applications/index.cjsView file

Lines 32-72javascript

32 mod

33));

34var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

35

36// node_modules/tsup/assets/cjs_shims.js

package.jsonView file

Lines 26-66json

26 }

27 },

28 "./applications": {

29 "import": {

30 "types": "./dist/applications/index.d.ts",

31 "default": "./dist/applications/index.js"

32 },

33