Benign python Download

abstract-hugpy-dev 0.1.61

Legitimate self-hosted LLM orchestration software

“Self-hosted LLM console: model registry & downloads, streaming chat, OpenAI-compatible /v1 API with on-site keys, GPU worker fleet with cro…”

HTTP request carries form shell injectionCreates elevated logon scheduled task

Evidence

CSS sets element width to zero lines 1–2
1/*! For license information please see main.3d196f1275bfc1843a2f.js.LICENSE.txt */
2(()=>{"use strict";var e,n,t={126(e,n,t){t.d(n,{A:()=>s});var r=t(601),a=t.n(r),o=t(314),l=t.n(o)()(a());l.push([e.id,".layout {\n height: 100%;\n display: flex;\n flex-direction: column;\n}\n\n.topbar {\n display: flex;\n align-items: center;\n justify-content: space-between;\n gap: 12px;\n padding: 9px 14px;\n border-bottom: 1px solid var(--border);\n background: linear-gradient(180deg, var(--surface-2), var(--surface-1));\n flex-shrink: 0;\n}\n\n.topbar-left {\n display: flex;\n align-items: center;\n gap: 16px;\n min-width: 0;\n}\n\n.logo {\n color: var(--bright);\n font-weight: 700;\n font-size: 14px;\n white-space: nowrap;\n display: flex;\n a …
HTTP POST method string literal line 2
2:82613… tokens (--bg, --accent, --surface-1, …). Brand fonts\n (Saira display + JetBrains Mono) are imported and scoped to .docs — delete the\n @import if the app already loads them globally. */\n\n.docs {\n --font-display: 'Saira', system-ui, sans-serif;\n --font-mono: 'JetBrains Mono', ui-monospace, monospace;\n --accent-2: #7be5f5;\n --sidebar-w: 270px;\n --toc-w: 232px;\n --top …
Sets POST as an HTTP request method line 2
2:278400… sync()=>{if("open"!==(await g()).mode)try{const e=await x(f.me,{method:"GET",headers:{Accept:"application/json"}});if(e.ok)return void i({status:"authed",user:await e.json()});401!==e.status&&403!==e.status||i({status:"guest"})}catch{i(e=>"checking"===e.status?{status:"guest"}:e)}else i({status:"authed",user:{username:"local",local:!0}})},[g,x,f.me]),v=(0,o.useCallback)(async(e,n)=>"open"===(await g()).mode||(await x(f.login,{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:JSON.stringify({username:e,password:n})})).ok?(await b(),!0):(i({status:"guest"}),!1),[g,x,f.login,b]),y=(0,o.useCallback)(async()=>{if("open"!==(await g()).mode)try{await x(f.logo …
Large minified JavaScript bundle line 2
2:385908… l route here; general traffic won't.`,e.pool||"");if(null!==n)try{await Cn(`/api/llm/workers/${encodeURIComponent(e.id)}/pool`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({pool:n.trim()})}),x()}catch(e){alert(`Set pool failed: ${e.message}`)}},[x]),R=(0,o.useCallback)(async()=>{const e=t.filter(e=>"online"!==e.status);e.length&&confirm(`Remove ${e.length} offl …
Shell separator plus command token line 2
2:386754… ll!=t.memory_free&&(n+=t.memory_free)}return{total:e,free:n,used:Math.max(e-n,0),loaded:r,hasVram:a}},[t]),I=`curl -fsSL ${Nn()}/api/llm/workers/install.sh | bash`,L=c.models.split(",").map(e=>e.trim()).filter(Boolean);return(0,Rn.jsxs)("div",{className:"workers-panel",children:[(0,Rn.jsxs)("div",{className:"wp-bar"+(n?" wp-bar-static":""),onClick:n?void 0:()=>i(e=>!e),children:[(0,Rn.jsx)("span",{className:"wp-tit …

Showing the top 5 files — 7 more files (174 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.