@redhat-cloud-services/frontend-components-config@6.14.5
Config plugins and settings for RedHat Cloud Services project.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe package has no install-time scripts and the required build path is an explicit webpack build helper. No concrete malicious behavior was found in the inspected entrypoints.
Static reason
One or more suspicious static signals were detected.
Trigger
No malicious trigger was identified.
Impact
No malicious impact was identified.
Mechanism
No malicious mechanism was identified.
AI rationale
The package has no install-time scripts and the required build path is an explicit webpack build helper. No concrete malicious behavior was found in the inspected entrypoints.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no lifecycle scripts, so installation does not run package code.
- The required build helper uses caller-provided configuration and working directory to invoke webpack when the build command is used.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcebin/build-script.jsView file
6var path_1 = require("path");
L7: var child_process_1 = require("child_process");
L8: function buildScript(argv, cwd) {
High
Child Process
Package source references child process execution.
bin/build-script.jsView on unpkg · L620cwd: cwd,
L21: shell: true,
L22: });
High
17process.env.NODE_ENV = 'production';
L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {
L19: stdio: [process.stdout, process.stdout, process.stdout],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/build-script.jsView on unpkg · L1717
Findings
3 High4 Medium5 Low
HighChild Processbin/build-script.js
HighShellbin/build-script.js
HighRuntime Package Installbin/build-script.js
MediumDynamic Requirebin/webpack.plugins.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencebin/build-script.js
Affected versions and remediation
This report applies to @redhat-cloud-services/frontend-components-config@6.14.5.
See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.
- Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.