registry / @emilgroup/discount-sdk / 1.5.0
@emilgroup/discount-sdk@1.5.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is a generated EMIL API client. Its prepare script builds the package, its main entry point only exports API modules, and the flagged shell helper performs Git operations only when explicitly run.
Static reason
No blocking static signals were detected.
Trigger
API requests require a caller to use the client; the shell helper requires manual invocation.
Impact
No automatic data collection or account action was identified. Manually running the helper can push staged files to its configured Git remote.
Mechanism
The client sends authentication and API requests to its configured EMIL service. The helper stages, commits, and pushes files when run by a user.
AI rationale
The package is a generated EMIL API client. Its prepare script builds the package, its main entry point only exports API modules, and the flagged shell helper performs Git operations only when explicitly run.
Evidence
git_push.sh
Network endpoints5
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is `prepare`, which runs the TypeScript build.
- The main entry point exports the generated API, configuration, and models without making API calls itself.
- The SDK’s default API host is `https://apiv2.emil.de`; authentication requests are part of its explicit authorization methods.
- `git_push.sh` stages and pushes files only when manually run.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
#
Low
Ai Review Evidence
`git_push.sh` stages and pushes files only when manually run.
git_push.shView on unpkg · L31package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
"axios"
Low
Suspicious Lifecycle Evidence
Findings
4 Medium6 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatadist/base.js
MediumStripped Provenance Metadatadist/base.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.5.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.