@huggingface/transformers
State-of-the-art Machine Learning for the web. Run 🤗 Transformers directly in your browser, with no need for a server!
38
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
julien-cpierriccoyotte508xenovagary149
Keywords
transformerstransformers.jshuggingfacehugging facemachine learningdeep learningartificial intelligenceAIML
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Pre-release major version (4.0.0-next.x) from trusted HuggingFace publisher xenova with clean track record; likely a CI/CD pipeline change during major version development. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @huggingface/tokenizers is a first-party Hugging Face dependency, expected for this package's v4 major version. Not a supply-chain risk. | ai | |
| source-diff | obfuscated-file:dist/transformers.web.js | AI (source-diff): Standard webpack bundle output for a large ML library. Webpack comments and external module declarations are clearly visible in the sample. Expected artifact of the documented build process. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large ML library ships pre-built webpack bundles and source maps for browser/Node targets. New files are expected dist artifacts, not injected code. | ai | |
| source-diff | obfuscated-file:dist/transformers.node.mjs | AI (source-diff): Standard webpack bundle output for Node.js target. Sample shows recognizable webpack module structure with legitimate imports (fs, onnxruntime-node, path, sharp, url). | ai | |
| source-diff | net-exec-file:dist/ort-wasm-simd-threaded.jsep.mjs | AI (source-diff): Emscripten-compiled ONNX Runtime WASM loader. Network+exec pattern is WASM binary fetch and WebAssembly.instantiate — standard and expected for any WASM-based ML runtime. | ai | |
| provenance | no-provenance | AI (provenance): Already marked accepted risk; Hugging Face/xenova is a well-established publisher with a strong track record. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 4.2.0 | 5 / 8 | |
| 4.1.0 | 5 / 8 | |
| 4.0.1 | 5 / 8 | |
| 4.0.0 | 5 / 8 | |
| 3.8.1 | 4 / 13 | |
| 3.8.0 | 4 / 13 | |
| 3.7.6 | 4 / 13 | |
| 3.7.5 | 4 / 13 | |
| 3.7.4 | 4 / 13 | |
| 3.7.3 | 4 / 13 | |
| 3.7.2 | 4 / 13 | |
| 3.7.1 | 4 / 13 | |
| 3.7.0 | 4 / 13 | |
| 3.6.3 | 4 / 13 | |
| 3.6.2 | 4 / 13 | |
| 3.6.1 | 4 / 13 | |
| 3.6.0 | 4 / 13 | |
| 3.5.2 | 4 / 13 | |
| 3.5.1 | 4 / 13 | |
| 3.5.0 | 4 / 13 | |
| 3.4.2 | 4 / 13 | |
| 3.4.1 | 4 / 13 | |
| 3.4.0 | 4 / 13 | |
| 3.3.3 | 4 / 13 | |
| 3.3.2 | 4 / 13 | |
| 3.3.1 | 4 / 13 | |
| 3.3.0 | 4 / 13 | |
| 3.2.4 | 4 / 13 | |
| 3.2.3 | 4 / 13 | |
| 3.2.2 | 4 / 13 | |
| 3.2.1 | 4 / 13 | |
| 3.2.0 | 4 / 13 | |
| 3.1.2 | 4 / 13 | |
| 3.1.1 | 4 / 12 | |
| 3.1.0 | 4 / 12 | |
| 3.0.2 | 4 / 12 | |
| 3.0.1 | 4 / 12 | |
| 3.0.0 | 4 / 12 |