@redhat-cloud-services/frontend-components-config@6.14.7
Config plugins and settings for RedHat Cloud Services project.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a frontend build and local proxy package with no installation lifecycle hook or self-dependency. The flagged primitives are explicit CLI development operations, not an automatic or covert attack chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs an fec build, dev, dev-proxy, or related CLI command.
Impact
The selected development command can run build tools, manage its named containers, and create temporary configuration.
Mechanism
User-invoked frontend build and local development proxy tooling.
AI rationale
This is a frontend build and local proxy package with no installation lifecycle hook or self-dependency. The flagged primitives are explicit CLI development operations, not an automatic or covert attack chain.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes an explicit fec CLI, and its manifest has no lifecycle scripts.
- The invoked build command starts webpack through npm exec.
- The invoked dev-proxy command pulls and runs a named development container and writes a temporary routes file.
- The interceptor server fetches Red Hat Chrome service data for a local proxy.
- The flagged TypeScript template contains only compiler settings.
Evidence against
- No preinstall, install, postinstall, or self-dependency is present.
- No credential harvesting, exfiltration, obfuscation, eval, or hidden import-time execution was found.
- Network and shell activity is confined to named development/build commands and local proxy/container setup.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcebin/build-script.jsView file
6var path_1 = require("path");
L7: var child_process_1 = require("child_process");
L8: function buildScript(argv, cwd) {
High
Child Process
Package source references child process execution.
bin/build-script.jsView on unpkg · L617process.env.NODE_ENV = 'production';
L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {
L19: stdio: [process.stdout, process.stdout, process.stdout],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/build-script.jsView on unpkg · L17bin/webpack.plugins.jsView file
23Object.defineProperty(exports, "__esModule", { value: true });
L24: var frontend_components_config_utilities_1 = require("@redhat-cloud-services/frontend-components-config-utilities");
L25: var rootDir = process.env.FEC_ROOT_DIR || process.cwd();
Findings
1 Critical4 High4 Medium3 Low
CriticalPrevious Version Dangerous Deltabin/dev-proxy-script.js
HighChild Processbin/build-script.js
HighShell
HighRuntime Package Installbin/build-script.js
HighSemantic Analysis Limitedbin/tsconfig.template.json
MediumDynamic Requirebin/webpack.plugins.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @redhat-cloud-services/frontend-components-config@6.14.7.
See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.
- Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.