@redhat-cloud-services/frontend-components-config@6.14.10
Config plugins and settings for RedHat Cloud Services project.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package has no installation lifecycle hook and the inspected executable behavior is an explicit development/build workflow. No credential harvesting, exfiltration, hidden payload execution, or persistence was found in the inspected paths.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the fec command-line tool.
Impact
No confirmed malicious impact was established.
Mechanism
The inspected build helper launches webpack using the selected project configuration; no install-time execution is declared.
AI rationale
The package has no installation lifecycle hook and the inspected executable behavior is an explicit development/build workflow. No credential harvesting, exfiltration, hidden payload execution, or persistence was found in the inspected paths.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no lifecycle scripts, so installation does not trigger package code.
- The declared executable is the fec command-line tool.
- The required build helper runs webpack for the supplied project configuration.
- The command-line tool exposes named development and build actions, including its TypeScript setup action.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcebin/build-script.jsView file
6var path_1 = require("path");
L7: var child_process_1 = require("child_process");
L8: function buildScript(argv, cwd) {
High
Child Process
Package source references child process execution.
bin/build-script.jsView on unpkg · L620cwd: cwd,
L21: shell: true,
L22: });
High
17process.env.NODE_ENV = 'production';
L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {
L19: stdio: [process.stdout, process.stdout, process.stdout],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/build-script.jsView on unpkg · L17bin/webpack.plugins.js
Findings
3 High4 Medium5 Low
HighChild Processbin/build-script.js
HighShellbin/build-script.js
HighRuntime Package Installbin/build-script.js
MediumDynamic Requirebin/webpack.plugins.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @redhat-cloud-services/frontend-components-config@6.14.10.
See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.
- Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.