earth2studio-create-diagnostic
Warn
Audited by Socket on Jul 22, 2026
1 alert found:
SecuritySecurityreferences/method-templates.py
MEDIUMSecurityMEDIUM
references/method-templates.py
This module is an ML inference wrapper that loads a remotely sourced model package and performs inference. The main supply-chain security weakness is the use of `torch.load(..., weights_only=False)` on an externally obtained `model.pt`, which can enable arbitrary code execution during deserialization if the artifact is malicious or tampered with. Other logic is largely standard (coordinate handling, normalization, and tensor arithmetic) with no obvious exfiltration or persistence mechanisms visible. Mitigate by strongly verifying/pinning artifact integrity and using safer loading constraints (e.g., weights-only/safe serialization) where compatible.
Confidence: 68%Severity: 72%
Audit Metadata