registry  /  @ministryofjustice/hmpps-connect-dps-components  /  6.3.0

@ministryofjustice/hmpps-connect-dps-components@6.3.0

A package to allow the inclusion of connect DPS micro frontend components within DPS applications

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessShell
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 27.2 KB of source

Source & flagged code

2 flagged · loading source
scripts/install.tsView file
2/* eslint-disable no-console */ L3: import { execSync } from 'node:child_process' L4: import { resolve } from 'node:path'
High
Child Process

Package source references child process execution.

scripts/install.tsView on unpkg · L2
6console.info('→ Installing @ministryofjustice/hmpps-connect-dps-components') L7: execSync('npm install --save-prod @ministryofjustice/hmpps-connect-dps-components') L8:
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install.tsView on unpkg · L6

Findings

3 High2 Low
HighChild Processscripts/install.ts
HighShell
HighRuntime Package Installscripts/install.ts
LowNon Install Lifecycle Scripts
LowScripts Present