registry / @emilgroup/discount-sdk / 1.8.0
@emilgroup/discount-sdk@1.8.0
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is an OpenAPI-generated EMIL DiscountService client. Its only lifecycle script builds the package, and the standalone Git push helper is not invoked automatically.
Static reason
No blocking static signals were detected.
Trigger
API network requests occur when callers invoke SDK methods; the prepare script builds the package.
Impact
No automatic data collection, unrelated network contact, or other attack behavior was identified.
Mechanism
Requests use the configured EMIL API base path and caller-supplied request data and credentials. The shell helper is not wired to package lifecycle or import behavior.
AI rationale
The package is an OpenAPI-generated EMIL DiscountService client. Its only lifecycle script builds the package, and the standalone Git push helper is not invoked automatically.
Network endpoints5
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point re-exports SDK modules; it does not initiate a request at import time.
- The prepare lifecycle script only runs the TypeScript build.
- The SDK's default API host is apiv2.emil.de, and its API methods construct requests when called.
- git_push.sh is a standalone helper that requires explicit execution.
Evidence against
- The SDK stores and reuses an access token for its intended API requests.
- git_push.sh defaults to a publisher-named GitHub repository if run without arguments.
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
1#!/bin/sh
# ref: https://help.github.com/articles/adding-an-existing-project-to-github-using-the-command-line/
#
# Usage example: /bin/sh ./git_push.sh wing328 openapi-petstore-perl "minor update" "gitlab.com"
git_user_id=$1
git_repo_id=$2
release_note=$3
git
Low
Ai Review Evidence
git_push.sh is a standalone helper that requires explicit execution.
git_push.shView on unpkg · L1dist/index.jsView file
27reateBinding(exports, m, p);
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.BaseAPI = exports.Environment = void 0;
var base_1 = require("./base");
Object.defineProperty(exports, "Environment", { enumerable: true, get: function () { return base_1.Enviro
Low
Ai Review Evidence
The package entry point re-exports SDK modules; it does not initiate a request at import time.
dist/index.jsView on unpkg · L27package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
Low
Suspicious Lifecycle Evidence
The prepare lifecycle script only runs the TypeScript build.
package.jsonView on unpkg · L14base.tsView file
23export const BASE_PATH = "https://apiv2.emil.de".replace(/\/+$/, "");
/**
*
* @export
*/
export const COLLECTION_FORMATS = {
csv: ",",
ssv: " ",
tsv: "\t",
pipes: "|",
};
export in
Low
Ai Review Evidence
The SDK's default API host is apiv2.emil.de, and its API methods construct requests when called.
base.tsView on unpkg · L23Findings
2 Medium7 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowAi Review Evidencedist/index.js
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebase.ts
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.8.0.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.