registry / @emilgroup/discount-sdk / 1.2.0
@emilgroup/discount-sdk@1.2.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis is a generated Axios client for Emil’s DiscountService. Its lifecycle hook only builds the package, and the reviewed network and token behavior supports explicit API use.
Static reason
No blocking static signals were detected.
Trigger
API network requests occur when application code invokes SDK methods; the prepare hook runs the build.
Impact
No unrelated data collection or unauthorized account action was identified.
Mechanism
The SDK sends supplied credentials or API requests to its configured Emil service endpoint. Browser token persistence uses localStorage.
AI rationale
This is a generated Axios client for Emil’s DiscountService. Its lifecycle hook only builds the package, and the reviewed network and token behavior supports explicit API use.
Network endpoints5
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is `prepare`, which runs the TypeScript build.
- The package entry point exports generated SDK APIs, configuration, and models; it does not make an API request itself.
- The SDK’s default endpoint is `https://apiv2.emil.de`, with other configured Emil environment endpoints.
- The `authorize(username, password)` method posts the supplied credentials to the configured API’s login endpoint.
- Token storage and loading are guarded by a browser check and use `localStorage`.
- The Git push helper is a separate shell file, not part of the declared lifecycle scripts.
Evidence against
- The README describes this package as an Axios client for Emil’s DiscountService and shows authorization and API calls as explicit application code.
- No unrelated collector, automatic install-time data transfer, or reviewer-directed instruction was identified.
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
"axios"
Low
Suspicious Lifecycle Evidence
The only lifecycle script is `prepare`, which runs the TypeScript build.
package.jsonView on unpkg · L1414"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
"axios"
Low
Suspicious Lifecycle Evidence
The Git push helper is a separate shell file, not part of the declared lifecycle scripts.
Findings
3 Medium8 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatadist/base.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/base.js
LowAi Review Evidencedist/base.js
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.2.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.