@redhat-cloud-services/frontend-components-config@6.14.8
Config plugins and settings for RedHat Cloud Services project.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner signals are explained by an explicitly invoked frontend-development CLI, while the manifest has no lifecycle hooks. Source inspection found no automatic execution, credential theft, exfiltration, or concealed payload.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a fec build, development, proxy, or TypeScript patch command.
Impact
Explicit commands may modify the consumer project's TypeScript setup and start local development services.
Mechanism
Developer CLI orchestration for webpack, TypeScript, and local containers.
AI rationale
The scanner signals are explained by an explicitly invoked frontend-development CLI, while the manifest has no lifecycle hooks. Source inspection found no automatic execution, credential theft, exfiltration, or concealed payload.
Evidence
package.jsontsconfig.json
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a fec CLI and has no install lifecycle script.
- An explicit fec command can add a TypeScript postinstall entry to the consumer project.
- The build command runs webpack only after the build CLI command is selected.
- The dev-proxy command pulls and runs named development containers.
- The optional interceptor fetches Chrome configuration only when enabled by the project configuration.
- The flagged TypeScript file is a plain compiler-options template.
Evidence against
- No automatic preinstall, install, or postinstall execution exists in this package.
- No credential harvesting, secret exfiltration, obfuscated payload, or remote code execution was found.
- Network and container operations are confined to explicitly invoked development commands.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcebin/build-script.jsView file
6var path_1 = require("path");
L7: var child_process_1 = require("child_process");
L8: function buildScript(argv, cwd) {
High
Child Process
Package source references child process execution.
bin/build-script.jsView on unpkg · L617process.env.NODE_ENV = 'production';
L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {
L19: stdio: [process.stdout, process.stdout, process.stdout],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/build-script.jsView on unpkg · L17bin/webpack.plugins.jsView file
23Object.defineProperty(exports, "__esModule", { value: true });
L24: var frontend_components_config_utilities_1 = require("@redhat-cloud-services/frontend-components-config-utilities");
L25: var rootDir = process.env.FEC_ROOT_DIR || process.cwd();
Findings
1 Critical4 High4 Medium3 Low
CriticalPrevious Version Dangerous Deltabin/dev-proxy-script.js
HighChild Processbin/build-script.js
HighShell
HighRuntime Package Installbin/build-script.js
HighSemantic Analysis Limitedbin/tsconfig.template.json
MediumDynamic Requirebin/webpack.plugins.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @redhat-cloud-services/frontend-components-config@6.14.8.
See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.
- Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.