registry / @emilgroup/discount-sdk / 1.14.1-beta.7
@emilgroup/discount-sdk@1.14.1-beta.7
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe prepare script only compiles the SDK, and the default network endpoint belongs to Emil’s DiscountService. The git push helper can publish files and use GIT_TOKEN, but it is not automatically invoked.
Static reason
No blocking static signals were detected.
Trigger
API requests occur when consumers call SDK methods; the shell helper runs only when explicitly invoked.
Impact
No automatic credential exfiltration, unrelated network contact, or unrequested account action was found.
Mechanism
The SDK sends configured requests to Emil’s API via Axios. The prepare hook runs the local TypeScript build.
AI rationale
The prepare script only compiles the SDK, and the default network endpoint belongs to Emil’s DiscountService. The git push helper can publish files and use GIT_TOKEN, but it is not automatically invoked.
Network endpoints1
apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only declared lifecycle hook is prepare, which runs the TypeScript build.
- The package entry point exports the generated SDK modules; importing it does not itself make an API request.
- The generated client defaults to Emil’s API at https://apiv2.emil.de, with requests made through Axios when SDK methods are called.
Evidence against
- The shipped git_push.sh helper stages, commits, and pushes files, and can use GIT_TOKEN; it is not wired to a package lifecycle script.
- The client reads and stores APP_TOKEN in browser localStorage when a BaseAPI instance is constructed.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repo
Low
Suspicious Lifecycle Evidence
The only declared lifecycle hook is prepare, which runs the TypeScript build.
git_push.shView on unpkg · L31package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
"axios"
Low
Findings
2 Medium8 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/base.js
LowAi Review Evidencedist/common.js
LowSuspicious Lifecycle Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.14.1-beta.7.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.14.1-beta.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.