registry / @cap-ts/esi / 1.8.17

@cap-ts/esi@1.8.17

Enterprise System Integration Based on SAP CAP

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Importing the package reaches a configuration loader that performs an HTTPS GET to a destination concealed by string obfuscation. No confirmed data-exfiltration or destructive action was established.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading the package runtime entry point.

Impact

A consumer process can make an unreviewable network request during import and accept remotely supplied configuration.

Mechanism

The imported implementation loads the interface, whose configuration setup calls a helper that synchronously fetches and parses remote configuration while hiding the destination.

AI rationale

An import-time request to a concealed remote endpoint is a concrete unresolved supply-chain risk. There is insufficient source evidence of an active attack to block publication.

Evidence

src/index.jssrc/lib/impl/index.jssrc/lib/_interface/index.jssrc/lib/_interface/file/index.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The metadata selects src/index.js as the runtime entry point and has no lifecycle scripts.

@cap-ts/esi@1.8.17

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code