registry / @redhat-cloud-services/frontend-components-config / 6.14.4

@redhat-cloud-services/frontend-components-config@6.14.4

⚠ Under review

Config plugins and settings for RedHat Cloud Services project.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 122 KB of source, external domains: app-interface.apps.rosa.appsrep09ue1.03r5.p3.openshiftapps.com, github.com, raw.githubusercontent.com, squid.corp.redhat.com

Source & flagged code

4 flagged

bin/build-script.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.buildScript = buildScript;

4var frontend_components_config_utilities_1 = require("@redhat-cloud-services/frontend-components-config-utilities");

5var common_1 = require("./common");

6var path_1 = require("path");

7var child_process_1 = require("child_process");

8function buildScript(argv, cwd) {

High

Child Process

Package source references child process execution.

bin/build-script.jsView on unpkg · L6

9 var configPath;

10 if (typeof argv.webpackConfig !== 'undefined') {

11 configPath = (0, common_1.getWebpackConfigPath)(argv.webpackConfig, cwd);

12 }

13 else {

14 (0, common_1.validateFECConfig)(cwd);

15 configPath = (0, path_1.resolve)(__dirname, './prod.webpack.config.js');

16 }

17 process.env.NODE_ENV = 'production';

18 var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {

19 stdio: [process.stdout, process.stdout, process.stdout],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build-script.jsView on unpkg · L17

20 cwd: cwd,

21 shell: true,

22 });

23 subprocess.on('error', function (err) {

24 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, err);

25 process.exit(1);

26 });

27 subprocess.on('exit', function (code, signal) {

28 if (code) {

29 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, 'Exited with code', code);

30 process.exit(code);

31 }

32 else if (signal) {

33 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, 'Exited with signal', signal);

34 process.exit(1);

35 }

36 else {

37 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.info, 'Exited Okay');

bin/webpack.plugins.jsView file

Lines 3-43javascript

3 __assign = Object.assign || function(t) {

4 for (var s, i = 1, n = arguments.length; i < n; i++

bin/dev-proxy-script.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @redhat-cloud-services/frontend-components-config@6.12.0 matchedIdentity = npm:[redacted]:6.12.0 similarity = 0.824 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/dev-proxy-script.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/build-script.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code