registry / @emilgroup/discount-sdk / 1.4.0
@emilgroup/discount-sdk@1.4.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe lifecycle script only builds the package, and importing the entry point only loads generated client modules. Authentication and token refresh use the configured Emil API host, with no evidence of unrelated collection or automatic account actions.
Static reason
No blocking static signals were detected.
Trigger
API calls occur when a consumer calls client methods; authentication occurs when the consumer calls `authorize`.
Impact
No malicious or suspicious behavior was identified.
Mechanism
The client sends API credentials and refresh requests to the configured service host. The prepare script runs the TypeScript build.
AI rationale
The lifecycle script only builds the package, and importing the entry point only loads generated client modules. Authentication and token refresh use the configured Emil API host, with no evidence of unrelated collection or automatic account actions.
Network endpoints1
apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is `prepare`, which runs the TypeScript build; no install or postinstall hook is declared.
- The published entry point re-exports the generated API, configuration, and model modules without making a request at import time.
- The `authorize` method sends supplied credentials to the configured Emil API login endpoint; the default API host is `https://apiv2.emil.de`.
- Token refresh targets the configured Emil API and is invoked from the response interceptor after an API request fails.
- `git_push.sh` is a standalone development helper and is not called by the package scripts.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
32git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed
Low
Ai Review Evidence
`git_push.sh` is a standalone development helper and is not called by the package scripts.
git_push.shView on unpkg · L32package.jsonView file
17"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
Low
Suspicious Lifecycle Evidence
The only lifecycle script is `prepare`, which runs the TypeScript build; no install or postinstall hook is declared.
package.jsonFindings
4 Medium7 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatabase.ts
MediumStripped Provenance Metadatabase.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencebase.ts
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.4.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.