registry / @emilgroup/discount-sdk / 1.7.0
@emilgroup/discount-sdk@1.7.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis is an OpenAPI-generated client whose entry point re-exports API modules and whose requests are made through explicit method calls to Emil service endpoints. The prepare hook only runs the build, while git_push.sh is a manual release helper.
Static reason
No blocking static signals were detected.
Trigger
Network requests occur when a consumer calls an API method; prepare runs the TypeScript build.
Impact
No automatic data collection, unrelated host contact, or hidden startup action was found.
Mechanism
The SDK sends configured API requests to its Emil service and supports its own access-token handling.
AI rationale
This is an OpenAPI-generated client whose entry point re-exports API modules and whose requests are made through explicit method calls to Emil service endpoints. The prepare hook only runs the build, while git_push.sh is a manual release helper.
Network endpoints5
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point re-exports the generated SDK modules; it contains no startup request.
- The default API host is the package’s Emil DiscountService host, https://apiv2.emil.de.
- The health-check request is made through an explicit check() method call.
- The prepare script runs the TypeScript build; git_push.sh is a separate Git release helper.
Evidence against
- The SDK stores and uses Emil API access tokens for its intended service.
- git_push.sh stages and pushes repository contents when manually run.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
# Sets the new remote
git_remote=$(git remote)
if [ "$git_remote" = "" ]; then #
Low
Ai Review Evidence
The prepare script runs the TypeScript build; git_push.sh is a separate Git release helper.
git_push.shView on unpkg · L31index.tsView file
15export { Environment, BaseAPI } from "./base";
export * from "./api";
export * from "./configuration";
export * from ".
Low
Findings
2 Medium8 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowAi Review Evidenceindex.ts
LowAi Review Evidencebase.ts
LowAi Review Evidenceapi/default-api.ts
LowAi Review Evidencepackage.json
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.7.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.