registry / @emilgroup/discount-sdk / 1.8.1-beta.18
@emilgroup/discount-sdk@1.8.1-beta.18
OpenAPI client for @emilgroup/discount-sdk
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package exports an Emil API client whose requests and token handling serve its stated purpose. The prepare script only builds TypeScript, and the included Git push helper is not invoked automatically.
Static reason
No blocking static signals were detected.
Trigger
A consumer calls an SDK API method, authorize, or a request with an expired token.
Impact
Expected API requests and token refreshes for the consumer's Emil account; no unrelated collection or automatic account action was found.
Mechanism
The SDK uses Axios with the configured base path, defaulting to the Emil API, and stores browser token data for later use.
AI rationale
The package exports an Emil API client whose requests and token handling serve its stated purpose. The prepare script only builds TypeScript, and the included Git push helper is not invoked automatically.
Evidence
base.tsdist/base.jscommon.tsgit_push.sh
Network endpoints6
apiv2.emil.deapiv2-test.emil.deapiv2-staging.emil.deapiv2-dev.emil.deeu-central-2.apiv2.emil.deeu-central-2.apiv2-staging.emil.de
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to dist/index.js and defines prepare only as a TypeScript build; it has no install, preinstall, or postinstall hook.
- The entry point exports SDK classes and modules; it does not start a request or background task.
- Login and workspace-switch requests are implemented as explicit methods and use the configured service base path.
- Token data is read from and written to browser storage; in non-browser environments the SDK initializes it as empty.
- Automatic token refresh is limited to API errors such as 401/403 or certain network errors on requests with an Authorization header.
- git_push.sh stages, commits, and pushes files only when explicitly run; it is not called by the manifest scripts.
Evidence against
- The package has network-capable SDK behavior, but it is directed at the Emil API service and used for client-requested API operations.
- The prepare script runs the build compiler, not code that contacts a collector or reads project data.
Behavioral surface
Network
Source & flagged code
8 flaggedgit_push.shView file
•path = git_push.sh
kind = build_helper
sizeBytes = 1824
magicHex = [redacted]
Medium
31# Initialize the local directory as a Git repository
git init
# Adds the files in the local repository and stages them for commit.
git add .
# Commits the tracked changes and prepares them to be pushed to a remote repository.
gi
Low
Ai Review Evidence
git_push.sh stages, commits, and pushes files only when explicitly run; it is not called by the manifest scripts.
git_push.shView on unpkg · L31package.jsonView file
14"main": "./dist/index.js",
"typings": "./dist/index.d.ts",
"scripts": {
"build": "tsc --outDir dist/",
"prepare": "npm run build"
},
"dependencies"
Low
Findings
3 Medium9 Low
MediumNetwork
MediumShips Build Helpergit_push.sh
MediumStripped Provenance Metadatabase.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencebase.ts
LowAi Review Evidencebase.ts
LowAi Review Evidencegit_push.sh
LowAi Review Evidencebase.ts
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.8.1-beta.18.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Review the evidence and your use of @emilgroup/discount-sdk@1.8.1-beta.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.