registry / @emilgroup/discount-sdk / 1.3.1-beta.0
@emilgroup/discount-sdk@1.3.1-beta.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is a generated Emil DiscountService client whose requests are made through API methods and use configured credentials. Its prepare hook only builds the package, and the shipped git-push script is not run automatically.
Static reason
No blocking static signals were detected.
Trigger
Consumers make API calls through SDK methods; the shell helper acts only when manually invoked.
Impact
No automatic data collection or account action was identified. The helper can push repository contents when a user invokes it.
Mechanism
The SDK sends configured requests to Emil DiscountService endpoints. The helper stages, commits, and pushes the current repository when run.
AI rationale
The package is a generated Emil DiscountService client whose requests are made through API methods and use configured credentials. Its prepare hook only builds the package, and the shipped git-push script is not run automatically.
Network endpoints6
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.degithub.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point is a generated SDK that exports API, configuration, and model modules.
- The prepare script only runs the TypeScript build.
- API requests use the Emil DiscountService endpoint, and credentials are supplied through SDK configuration or explicit authorization.
- The repository-push helper is a standalone script, not a lifecycle hook.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
# Sets the new remote
git_remot
Low
Suspicious Lifecycle Evidence
The repository-push helper is a standalone script, not a lifecycle hook.
git_push.shView on unpkg · L31dist/index.jsView file
29Object.defineProperty(exports, "__esModule", { value: true });
exports.BaseAPI = exports.Environment = void 0;
var base_1 = require("./base");
Object.defineProperty(exports, "Environment", { enumerable: true, g
Findings
4 Medium6 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatadist/base.js
MediumStripped Provenance MetadataREADME.md
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowAi Review Evidencedist/index.js
LowAi Review Evidencepackage.json
LowSuspicious Lifecycle Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.3.1-beta.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.3.1-beta.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.