registry / @emilgroup/discount-sdk / 1.3.0
@emilgroup/discount-sdk@1.3.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is a generated API client: its import entry exports SDK code, and prepare only builds TypeScript. Credentials are used with Emil’s configured API after explicit authorization, with no evidence of unrelated collection or automatic account actions.
Static reason
No blocking static signals were detected.
Trigger
API requests occur when a caller invokes SDK methods; authentication occurs when authorize is called. The prepare script builds the package.
Impact
No unsolicited credential transfer, install-time data collection, or import-time action was identified.
Mechanism
The SDK uses axios and defaults to Emil’s API host. The included shell helper performs git operations only when explicitly run.
AI rationale
The package is a generated API client: its import entry exports SDK code, and prepare only builds TypeScript. Credentials are used with Emil’s configured API after explicit authorization, with no evidence of unrelated collection or automatic account actions.
Evidence
dist/index.jsdist/base.jspackage.jsongit_push.sh
Network endpoints5
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package is an OpenAPI client whose main entry is dist/index.js; its prepare script only runs the TypeScript build.
- Importing the entry point exports SDK modules and does not itself issue requests.
- The SDK’s default API host is Emil’s apiv2.emil.de service.
- Credentials are sent to the configured service only through the explicit authorize(username, password) method.
- Token persistence is limited to browser storage, and git_push.sh stages and pushes files only when manually invoked.
Evidence against
- git_push.sh includes git add ., git pull, and git push commands, so manual use can stage and push the current directory’s contents.
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
# Sets the new remote
git_remot
Low
Ai Review Evidence
Token persistence is limited to browser storage, and git_push.sh stages and pushes files only when manually invoked.
git_push.shView on unpkg · L31package.jsonView file
12],
"license": "Unlicense",
"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
"axios": "^0.27.2"
},
"devDependencies": {
Findings
3 Medium8 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatadist/base.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/base.js
LowAi Review Evidencedist/base.js
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.3.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.