registry  /  @fiado/api-invoker  /  4.54.0

@fiado/api-invoker@4.54.0

Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is an internal API invoker library whose network behavior is explicit runtime use of service clients and SQS publishers configured by environment variables.

Static reason
No blocking static signals were detected.
Trigger
Consumer imports the library and calls exported API or publisher methods.
Impact
Caller-directed service requests; no evidence of credential harvesting, exfiltration, persistence, or install-time mutation.
Mechanism
Env-configured HTTP API/SQS invocation wrappers
Rationale
Source inspection shows package-aligned HTTP/SQS wrapper functionality activated by consumer method calls, with endpoints supplied via environment variables. No install-time execution, obfuscated payload, credential harvesting, file mutation, shell execution, or AI-agent control hijack was found.
Evidence
package.jsonbin/index.jssrc/index.tsbin/container.config.jsbin/stpServicePayment/api/StpServicePaymentApi.jsbin/authentication/AuthenticationApi.jsbin/credit-engine/queue/CreditStatementPublisher.jsbin/ai-engine-connector/AiEngineApi.jsbin/utils/InvokerUtils.js

Decision evidence

public snapshot
AI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for block
  • Runtime methods can send caller-provided requests to env-configured Lambda/API URLs via injected IHttpRequest.
  • SQS publisher classes send caller-provided messages to env-configured AWS SQS queue URLs.
Evidence against
  • package.json has only prepublishOnly build script; no preinstall/install/postinstall lifecycle execution.
  • bin/index.js only re-exports module entrypoints; no import-time shell, file mutation, or network call observed.
  • bin/container.config.js registers Inversify bindings for API clients/publishers; no persistence or agent control-surface mutation.
  • bin/stpServicePayment/api/StpServicePaymentApi.js and bin/authentication/AuthenticationApi.js build service URLs from process.env and invoke injected httpRequest methods.
  • bin/credit-engine/queue/CreditStatementPublisher.js uses AWS SDK SQS send only when publish() is called by a consumer.
  • Search found no child_process, eval/Function, native binary/wasm, credential-file reads, or filesystem writes.
Behavioral surface
Source
CryptoEnvironmentVars
Supply chain
HighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 619 file(s), 760 KB of source

Source & flagged code

0 flagged
No flagged code excerpts are attached to this scan.

Findings

1 Medium5 Low
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowAi Review Evidence
LowAi Review Evidence