registry / @emilgroup/discount-sdk / 1.4.1-beta.0
@emilgroup/discount-sdk@1.4.1-beta.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is a generated Emil discount-service API client. Its prepare script only builds the package, while network requests and authentication are performed through explicit SDK calls to configured service endpoints.
Static reason
No blocking static signals were detected.
Trigger
API calls occur when a consumer invokes SDK methods; authentication occurs when authorize is called.
Impact
No unsolicited collection, account action, or install-time behavior was found.
Mechanism
The SDK sends requested API calls and credentials to its configured Emil service base path and stores token data in browser local storage.
AI rationale
The package is a generated Emil discount-service API client. Its prepare script only builds the package, while network requests and authentication are performed through explicit SDK calls to configured service endpoints.
Network endpoints5
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point is the generated SDK, and its only prepare script runs the TypeScript build.
- Authentication is an explicit authorize call that sends credentials to the configured service base path.
- Token data is stored in browser local storage only when window exists.
- Generated API requests are created from SDK method arguments and sent through the configured Axios client.
Evidence against
- The shipped git_push.sh can stage and push files when manually run, but it is not invoked by the package lifecycle scripts.
Behavioral surface
Network
UrlStrings
Source & flagged code
7 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
# Sets the new remote
git_remote=$(git remote)
if [ "$git_remote" = "" ]; then #
Low
Ai Review Evidence
The package entry point is the generated SDK, and its only prepare script runs the TypeScript build.
git_push.shView on unpkg · L31package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
Findings
3 Medium8 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatabase.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencebase.ts
LowAi Review Evidencecommon.ts
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.4.1-beta.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.4.1-beta.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.