registry / @emilgroup/discount-sdk / 1.2.1-beta.0
@emilgroup/discount-sdk@1.2.1-beta.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe entry point only exports generated client code, and the lifecycle hook only runs a TypeScript build. Network activity is part of the documented Emil API client behavior and is triggered by explicit calls.
Static reason
No blocking static signals were detected.
Trigger
Importing the package exports its client classes. Requests occur when a caller invokes an API method or authorize().
Impact
No automatic data collection or unrelated outbound action was found.
Mechanism
The SDK sends requested API calls and login credentials to its configured Emil service base path. The shipped Git helper acts only when manually run.
AI rationale
The entry point only exports generated client code, and the lifecycle hook only runs a TypeScript build. Network activity is part of the documented Emil API client behavior and is triggered by explicit calls.
Network endpoints2
apiv2.emil.de/discountservice/v1/campaigns<configured Emil base path>/authservice/v1/login
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is prepare, which runs the TypeScript build.
- The main entry point re-exports API classes and configuration; it does not make a request at import time.
- The generated API builds service requests for explicit method calls, and authentication is performed through the SDK's authorize method.
- The shell helper stages and pushes files only when someone runs it manually.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repo
Low
Ai Review Evidence
The shell helper stages and pushes files only when someone runs it manually.
git_push.shView on unpkg · L31package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependen
Low
Suspicious Lifecycle Evidence
Findings
4 Medium6 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatadist/api/campaigns-api.js
MediumStripped Provenance Metadatadist/base.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.2.1-beta.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.2.1-beta.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.