registry / @emilgroup/discount-sdk / 1.14.1-beta.11
@emilgroup/discount-sdk@1.14.1-beta.11
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is a generated API client whose declared prepare script only builds the TypeScript output. Network requests use the Emil API when client methods are called, and the included Git publishing helper is not configured to run automatically.
Static reason
No blocking static signals were detected.
Trigger
API requests and authentication occur when a consumer calls the client methods; prepare runs the TypeScript build.
Impact
No automatic exfiltration, destructive action, or unrelated account action was found.
Mechanism
The client uses Axios with Emil API endpoints and stores its token data in browser storage. The Git helper requires explicit invocation.
AI rationale
The package is a generated API client whose declared prepare script only builds the TypeScript output. Network requests use the Emil API when client methods are called, and the included Git publishing helper is not configured to run automatically.
Network endpoints7
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.deeu-central-2.apiv2-staging.emil.de${git_host} (defaults to github.com in git_push.sh)
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point is generated SDK code; its only declared lifecycle script runs the TypeScript compiler.
- The client defaults to Emil’s API host, and its login method sends credentials to the configured API base path when called.
- The client reads and stores its APP_TOKEN data in browser storage; no unrelated credential collector was identified.
- git_push.sh documents explicit command-line use and pushes to its selected Git host; it is not configured as a lifecycle script.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
8 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
1#!/bin/sh
# ref: https://help.github.com/articles/adding-an-existing-project-to-github-using-the-command-line/
#
# Usage example: /bin/sh ./git_push.sh wing328 openapi-petstore-perl "minor update" "gitlab.com"
git_user_id=$1
git_repo_id=$2
release_note=$3
git
Low
Suspicious Lifecycle Evidence
git_push.sh documents explicit command-line use and pushes to its selected Git host; it is not configured as a lifecycle script.
git_push.shView on unpkg · L144if [ "$GIT_TOKEN" = "" ]; then
echo "[INFO] \$GIT_TOKEN (environment variable) is not set. Using the git credential in your environment."
git remote add origin https://${git_host}/${git_user_id}/${git_repo_id}.git
else
git remote add origin https://${git_user_id}:"${GIT_TOKEN}"@${git_hos
Low
Suspicious Lifecycle Evidence
git_push.sh documents explicit command-line use and pushes to its selected Git host; it is not configured as a lifecycle script.
Findings
2 Medium10 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencedist/index.js
LowAi Review Evidencedist/base.js
LowAi Review Evidencedist/base.js
LowAi Review Evidencedist/base.js
LowSuspicious Lifecycle Evidencegit_push.sh
LowSuspicious Lifecycle Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.14.1-beta.11.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.14.1-beta.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.