registry / @emilgroup/discount-sdk / 1.8.1-beta.16
@emilgroup/discount-sdk@1.8.1-beta.16
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThis is a generated API client whose authentication and service requests target its configurable EMIL API base path. Its `prepare` script only builds the package, and the shipped Git helper performs repository changes only when manually run.
Static reason
No blocking static signals were detected.
Trigger
Consumers explicitly construct a client and call its API or authentication methods; `prepare` builds the package.
Impact
No automatic credential exfiltration, unrelated account action, or install-time collection was found.
Mechanism
The client sends requested API and authentication calls to the configured EMIL service and stores browser token data in localStorage. The included Git helper acts only when manually run.
AI rationale
This is a generated API client whose authentication and service requests target its configurable EMIL API base path. Its `prepare` script only builds the package, and the shipped Git helper performs repository changes only when manually run.
Network endpoints6
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.deeu-central-2.apiv2-staging.emil.de
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle script is `prepare`, which runs the TypeScript build; no install-time data collection is shown.
- The package entry point exports the generated API client; the inspected entry contains no top-level account or network action.
- Login and token refresh requests use the configurable EMIL API base path, consistent with the SDK’s purpose.
- Token data is stored in browser `localStorage` for client use.
- The Git helper stages and pushes files only when manually run.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
git commit -m "$release_note"
# Sets the new remote
git_remote=$(git remote)
if [ "$git_remote" = "" ]; then # git remote not defin
Low
Ai Review Evidence
The Git helper stages and pushes files only when manually run.
git_push.shView on unpkg · L31package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies": {
"axios": "1.18.0"
Findings
2 Medium8 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencebase.ts
LowAi Review Evidencecommon.ts
LowAi Review Evidencegit_push.sh
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.8.1-beta.16.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.8.1-beta.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.