@redhat-cloud-services/frontend-components-config@6.14.15
Config plugins and settings for RedHat Cloud Services project.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe package has no install lifecycle hook. Its process execution, project configuration changes, and optional network access are tied to its command-line build and development functions, with no concrete malicious behavior established.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the fec command-line tool or enables the optional Chrome configuration interceptor in project configuration.
Impact
The observed effects are project setup and local development support; no credential theft, covert collection, or unrequested external action was established.
Mechanism
Build and TypeScript setup operate on the caller’s project; the optional interceptor fetches Chrome service data from its fixed backend.
AI rationale
The package has no install lifecycle hook. Its process execution, project configuration changes, and optional network access are tied to its command-line build and development functions, with no concrete malicious behavior established.
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no npm lifecycle scripts and exposes the command-line tool through its fec bin entry.
- The build helper launches webpack in the caller’s project directory as part of a requested build.
- The CLI’s TypeScript setup adds ts-patch to the caller’s postinstall and installs missing build dependencies; this is project setup behavior, not an npm lifecycle hook in this package.
- The Chrome configuration interceptor starts only when the project config enables interceptChromeConfig and retrieves Chrome service data from its fixed backend.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcebin/build-script.jsView file
6var path_1 = require("path");
L7: var child_process_1 = require("child_process");
L8: function buildScript(argv, cwd) {
High
Child Process
Package source references child process execution.
bin/build-script.jsView on unpkg · L620cwd: cwd,
L21: shell: true,
L22: });
High
17process.env.NODE_ENV = 'production';
L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {
L19: stdio: [process.stdout, process.stdout, process.stdout],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/build-script.jsView on unpkg · L1718
Findings
3 High4 Medium5 Low
HighChild Processbin/build-script.js
HighShellbin/build-script.js
HighRuntime Package Installbin/build-script.js
MediumDynamic Requirebin/webpack.plugins.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/build-script.js
Affected versions and remediation
This report applies to @redhat-cloud-services/frontend-components-config@6.14.15.
See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.
- Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.