registry / @emilgroup/discount-sdk / 1.8.1-beta.15
@emilgroup/discount-sdk@1.8.1-beta.15
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis version is a generated Axios API client. Its prepare script only builds the package, imports expose classes without making requests, and the publishing shell helper is not invoked automatically.
Static reason
No blocking static signals were detected.
Trigger
A consuming application must invoke an API method to send a request; the prepare hook only builds the package.
Impact
No malicious behavior was found in the reviewed package source.
Mechanism
Generated request functions use Axios and the configured or default Emil API base path.
AI rationale
This version is a generated Axios API client. Its prepare script only builds the package, imports expose classes without making requests, and the publishing shell helper is not invoked automatically.
Network endpoints1
apiv2.emil.de
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a generated SDK entry point; its prepare script only runs the TypeScript build.
- The generated client’s default API host is apiv2.emil.de.
- The request builder calls Axios only when a returned request function is invoked; callers may override the base path.
- The git_push.sh helper stages and commits files as part of an explicit publishing workflow.
Evidence against
- No automatic install-time network action or credential collection was identified.
- Importing the entry point only re-exports generated API classes.
- The shell helper is not declared as a lifecycle script.
Behavioral surface
Network
UrlStrings
Source & flagged code
5 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
34e local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
# Sets the
Low
Ai Review Evidence
The git_push.sh helper stages and commits files as part of an explicit publishing workflow.
git_push.shView on unpkg · L34package.jsonView file
13license": "Unlicense",
"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
"axios": "1.12.0"
Low
Ai Review Evidence
Findings
2 Medium7 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/base.js
LowAi Review Evidencedist/common.js
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.8.1-beta.15.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.8.1-beta.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.