@redhat-cloud-services/frontend-components-config@6.14.13
Config plugins and settings for RedHat Cloud Services project.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe package does not run lifecycle code on installation, but its CLI makes a persistent change to the consuming project's postinstall script. Classify this as a warning for user-invoked lifecycle setup; the inspected code does not show an active malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes the fec CLI.
Impact
Future installs in that project run the added ts-patch setup command.
Mechanism
The CLI checks project dependencies, adds ts-patch install to the project's postinstall script when absent, and writes the modified package.json.
AI rationale
The package does not run lifecycle code on installation, but its CLI makes a persistent change to the consuming project's postinstall script. Classify this as a warning for user-invoked lifecycle setup; the inspected code does not show an active malicious chain.
Evidence
bin/fec.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package has no install lifecycle scripts, so its project changes do not run automatically during package installation.
- Running the fec CLI can insert a ts-patch command into the consumer project's postinstall script and rewrite its package.json.
- The build command launches webpack in the selected project directory, consistent with the package's build-tool purpose.
- The interceptor server fetches Chrome service data from the project-aligned Red Hat Insights GitHub repository.
Evidence against
- The package manifest declares no lifecycle scripts.
- The inspected shell execution is tied to the build command, and the package exposes that command through its CLI.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcebin/build-script.jsView file
6var path_1 = require("path");
L7: var child_process_1 = require("child_process");
L8: function buildScript(argv, cwd) {
High
Child Process
Package source references child process execution.
bin/build-script.jsView on unpkg · L620cwd: cwd,
L21: shell: true,
L22: });
High
17process.env.NODE_ENV = 'production';
L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {
L19: stdio: [process.stdout, process.stdout, process.stdout],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/build-script.jsView on unpkg · L17bin/webpack.plugins.js
Findings
3 High6 Medium3 Low
HighChild Processbin/build-script.js
HighShellbin/build-script.js
HighRuntime Package Installbin/build-script.js
MediumDynamic Requirebin/webpack.plugins.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencebin/fec.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @redhat-cloud-services/frontend-components-config@6.14.13.
See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.
- Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.