registry / @emilgroup/discount-sdk / 1.14.1-beta.12
@emilgroup/discount-sdk@1.14.1-beta.12
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is a generated EMIL API client: its entry point exports API classes, and authentication requests are made by an explicit client method to the configured service. The prepare script only builds the package; the Git helper can publish files but does so only when separately invoked.
Static reason
No blocking static signals were detected.
Trigger
API requests occur when client methods such as authorize() are called. Git operations occur only when git_push.sh is run.
Impact
Expected API client traffic and an explicitly invoked Git push; no automatic exfiltration or unrelated behavior was found.
Mechanism
The client sends requests to the configured EMIL API. The shell helper initializes Git, stages files and pushes to its configured remote.
AI rationale
The package is a generated EMIL API client: its entry point exports API classes, and authentication requests are made by an explicit client method to the configured service. The prepare script only builds the package; the Git helper can publish files but does so only when separately invoked.
Network endpoints7
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.deeu-central-2.apiv2-staging.emil.degithub.com (default Git helper host; configurable)
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/index.js and its prepare script only runs the TypeScript build.
- The entry point re-exports the generated API and configuration modules.
- The API client loads stored token data when a BaseAPI instance is constructed; import itself does not initiate a request.
- Login credentials are sent to the configured API base path by an explicit authorize() call.
- The Git helper stages and pushes files only when the shell script is invoked.
Evidence against
- The package makes network requests as part of its intended API client behavior.
- The separately invoked Git helper can push the current directory to a configured remote.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
# Sets the new remote
git_remote=$(git remote)
if [ "$git_remote" = "" ]; then # git remote not defined
if [ "$GIT_TOKEN" = "" ]; then
ech
Low
Ai Review Evidence
The Git helper stages and pushes files only when the shell script is invoked.
git_push.shView on unpkg · L31package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/
Findings
3 Medium7 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatabase.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencebase.ts
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.14.1-beta.12.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.14.1-beta.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.