@redhat-cloud-services/frontend-components-config@6.14.16
Config plugins and settings for RedHat Cloud Services project.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install lifecycle hook, but invoking fec persistently adds a postinstall action before the requested subcommand is dispatched. This is linked to TypeScript build setup, yet the broad CLI activation leaves a residual concern about changing the consumer project's future install behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs fec in a project.
Impact
Future package installs in that project run the TypeScript patch setup command.
Mechanism
The CLI writes ts-patch install into the project's postinstall script, prefixing an existing command when present.
AI rationale
The package has no install lifecycle hook, but invoking fec persistently adds a postinstall action before the requested subcommand is dispatched. This is linked to TypeScript build setup, yet the broad CLI activation leaves a residual concern about changing the consumer project's future install behavior.
Evidence
package.jsonbin/fec.js
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no lifecycle scripts and exposes fec as a command-line tool.
- The fec startup routine reads the caller's package.json, adds ts-patch install to its postinstall script, preserves an existing postinstall command, and writes the file.
- The CLI runs this setup before dispatching the requested command; invoking fec is the activation condition.
- The setup installs missing TypeScript build dependencies and runs the TypeScript patch installer.
- The build helper runs webpack from the caller's project directory with its selected configuration.
Evidence against
- The manifest does not activate the package's behavior during installation; the package.json mutation requires running fec.
- The source ties the mutation to TypeScript build setup rather than unrelated data collection or account actions.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flagged · loading sourcebin/build-script.jsView file
6var path_1 = require("path");
L7: var child_process_1 = require("child_process");
L8: function buildScript(argv, cwd) {
High
Child Process
Package source references child process execution.
bin/build-script.jsView on unpkg · L620cwd: cwd,
L21: shell: true,
L22: });
High
17process.env.NODE_ENV = 'production';
L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {
L19: stdio: [process.stdout, process.stdout, process.stdout],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/build-script.jsView on unpkg · L17bin/webpack.plugins.js
Findings
3 High6 Medium3 Low
HighChild Processbin/build-script.js
HighShellbin/build-script.js
HighRuntime Package Installbin/build-script.js
MediumDynamic Requirebin/webpack.plugins.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @redhat-cloud-services/frontend-components-config@6.14.16.
See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.
- Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.16 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.