ai model report

Is dbdmg/wav2vec2-xls-r-300m-italian safe to load?

LOW risk. 7 of 272 tracked dependencies carry advisories, 1 malicious. Driven by pulls num2words unpinned; it had malicious releases that the registry no longer serves.

View on HuggingFace

// posture

fig. 01 — posture on eight axes, 100 is clean. Weakest: xyz safety at 50.

// the finding

5.0xyz score out of 10LOW

LOW2 dependency(ies) install straight from a VCS URL (resolves to whatever HEAD is at install time).

3 more findings on this model.

Author: dbdmg
Task: automatic-speech-recognition
Loader: transformers
License: apache-2.0
Downloads: 112,450
Remote code: not required

// dependencies

40 direct, 16 with findings, 244 reachable, 1 malicious

Package	Evidence	Advisories	Worst
num2wordsmalicious	direct, install	1	CRITICAL
transformers	direct, install	23	none pinned
torch	direct, install	12	hidden
numpy	direct, install	8	hidden
awscli	direct, install	3	hidden
scikit-learn	direct, install	3	hidden
python-dotenv	direct, install	1	hidden
bitsandbytes	direct, install	0	hidden

Create a free accountto see all 272 dependencies, which versions are pinned, and what to change.

Risk computed 2026-09-26 at 20:43 UTC. Dependencies come from the model's requirements, its declared loader and the code it ships; advisories from NVD, GHSA and OSV.