registry / @redhat-cloud-services/frontend-components-config / 6.14.6

@redhat-cloud-services/frontend-components-config@6.14.6

Config plugins and settings for RedHat Cloud Services project.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection found no lifecycle hook or concrete exfiltration behavior, but the CLI performs broad project mutation and command execution on user invocation. Downgrade to warn because this is a real, user-triggered dangerous capability and static analysis coverage was incomplete.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the fec CLI, including a build or development command.

Impact

The command can alter the caller's package.json, create tsconfig.json, and execute npm, yarn, and npx commands in that project.

Mechanism

Consumer-project postinstall mutation and development dependency installation.

AI rationale

Evidence

bin/fec.jspackage.jsontsconfig.json

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit fec CLI rewrites the consumer project's package.json to add a postinstall command.
The explicit fec CLI can install missing development dependencies and run ts-patch.
The build helper invokes webpack through a shell after a build command is requested.
The dev-proxy command dynamically loads project configuration and starts a development container.
The manifest exposes a CLI binary and has no automatic lifecycle scripts.
The flagged TypeScript template contains only compiler settings.

Evidence against

No preinstall, install, or postinstall hook is declared by this package.
The observed project mutation and command execution are reached through the user-invoked fec CLI, not package installation.
No credential harvesting, secret exfiltration, stealth persistence, or reviewer-directed text was found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Source & flagged code

5 flagged

bin/build-script.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.buildScript = buildScript;

4var frontend_components_config_utilities_1 = require("@redhat-cloud-services/frontend-components-config-utilities");

5var common_1 = require("./common");

6var path_1 = require("path");

7var child_process_1 = require("child_process");

8function buildScript(argv, cwd) {

High

Child Process

Package source references child process execution.

bin/build-script.jsView on unpkg · L6

9 var configPath;

10 if (typeof argv.webpackConfig !== 'undefined') {

11 configPath = (0, common_1.getWebpackConfigPath)(argv.webpackConfig, cwd);

12 }

13 else {

14 (0, common_1.validateFECConfig)(cwd);

15 configPath = (0, path_1.resolve)(__dirname, './prod.webpack.config.js');

16 }

17 process.env.NODE_ENV = 'production';

18 var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {

19 stdio: [process.stdout, process.stdout, process.stdout],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build-script.jsView on unpkg · L17

20 cwd: cwd,

21 shell: true,

22 });

23 subprocess.on('error', function (err) {

24 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, err);

25 process.exit(1);

26 });

27 subprocess.on('exit', function (code, signal) {

28 if (code) {

29 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, 'Exited with code', code);

30 process.exit(code);

31 }

32 else if (signal) {

33 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, 'Exited with signal', signal);

34 process.exit(1);

35 }

36 else {

37 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.info, 'Exited Okay');

bin/webpack.plugins.jsView file

Lines 3-43javascript

3 __assign = Object.assign || function(t) {

4 for (var s, i = 1, n = arguments.length; i < n; i++

bin/tsconfig.template.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/tsconfig.template.jsonView on unpkg

bin/dev-proxy-script.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @redhat-cloud-services/frontend-components-config@6.12.0 matchedIdentity = npm:[redacted]:6.12.0 similarity = 0.824 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/dev-proxy-script.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/build-script.jsView file

6var path_1 = require("path"); L7: var child_process_1 = require("child_process"); L8: function buildScript(argv, cwd) {

High

Child Process

Package source references child process execution.

bin/build-script.jsView on unpkg · L6

17process.env.NODE_ENV = 'production'; L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], { L19: stdio: [process.stdout, process.stdout, process.stdout],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build-script.jsView on unpkg · L17

bin/webpack.plugins.jsView file

23Object.defineProperty(exports, "__esModule", { value: true }); L24: var frontend_components_config_utilities_1 = require("@redhat-cloud-services/frontend-components-config-utilities"); L25: var rootDir = process.env.FEC_ROOT_DIR || process.cwd();

Findings

1 Critical4 High4 Medium3 Low

CriticalPrevious Version Dangerous Deltabin/dev-proxy-script.js

HighChild Processbin/build-script.js

HighShell

HighRuntime Package Installbin/build-script.js

HighSemantic Analysis Limitedbin/tsconfig.template.json

MediumDynamic Requirebin/webpack.plugins.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @redhat-cloud-services/frontend-components-config@6.14.6.

See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.

Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 11:15:11.917Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @redhat-cloud-services

Behavioral surface

Related packages

More from @redhat-cloud-services

Source & flagged code