registry / @redhat-cloud-services/frontend-components-config / 6.14.9

@redhat-cloud-services/frontend-components-config@6.14.9

Config plugins and settings for RedHat Cloud Services project.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 122 KB of source, external domains: app-interface.apps.rosa.appsrep09ue1.03r5.p3.openshiftapps.com, github.com, raw.githubusercontent.com, squid.corp.redhat.com

Source & flagged code

4 flagged

bin/build-script.jsView file

Lines 1-37javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.buildScript = buildScript;

4var frontend_components_config_utilities_1 = require("@redhat-cloud-services/frontend-components-config-utilities");

5var common_1 = require("./common");

6var path_1 = require("path");

7var child_process_1 = require("child_process");

8function buildScript(argv, cwd) {

High

Child Process

Package source references child process execution.

bin/build-script.jsView on unpkg · L6

9 var configPath;

10 if (typeof argv.webpackConfig !== 'undefined') {

11 configPath = (0, common_1.getWebpackConfigPath)(argv.webpackConfig, cwd);

12 }

13 else {

14 (0, common_1.validateFECConfig)(cwd);

15 configPath = (0, path_1.resolve)(__dirname, './prod.webpack.config.js');

16 }

17 process.env.NODE_ENV = 'production';

18 var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], {

19 stdio: [process.stdout, process.stdout, process.stdout],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build-script.jsView on unpkg · L17

20 cwd: cwd,

21 shell: true,

22 });

23 subprocess.on('error', function (err) {

24 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, err);

25 process.exit(1);

26 });

27 subprocess.on('exit', function (code, signal) {

28 if (code) {

29 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, 'Exited with code', code);

30 process.exit(code);

31 }

32 else if (signal) {

33 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.error, 'Exited with signal', signal);

34 process.exit(1);

35 }

36 else {

37 (0, frontend_components_config_utilities_1.fecLogger)(frontend_components_config_utilities_1.LogType.info, 'Exited Okay');

bin/webpack.plugins.jsView file

Lines 3-43javascript

3 __assign = Object.assign || function(t) {

4 for (var s, i = 1, n = arguments.length; i < n; i++

bin/tsconfig.template.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/tsconfig.template.jsonView on unpkg

Source & flagged code

4 flagged · loading source

bin/build-script.jsView file

6var path_1 = require("path"); L7: var child_process_1 = require("child_process"); L8: function buildScript(argv, cwd) {

High

Child Process

Package source references child process execution.

bin/build-script.jsView on unpkg · L6

17process.env.NODE_ENV = 'production'; L18: var subprocess = (0, child_process_1.spawn)("npm exec -- webpack -c ".concat(configPath), [], { L19: stdio: [process.stdout, process.stdout, process.stdout],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build-script.jsView on unpkg · L17

bin/webpack.plugins.jsView file

23Object.defineProperty(exports, "__esModule", { value: true }); L24: var frontend_components_config_utilities_1 = require("@redhat-cloud-services/frontend-components-config-utilities"); L25: var rootDir = process.env.FEC_ROOT_DIR || process.cwd();

Findings

4 High4 Medium3 Low

HighChild Processbin/build-script.js

HighShell

HighRuntime Package Installbin/build-script.js

HighSemantic Analysis Limitedbin/tsconfig.template.json

MediumDynamic Requirebin/webpack.plugins.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @redhat-cloud-services/frontend-components-config@6.14.9.

See all versions of @redhat-cloud-services/frontend-components-config for other recorded verdicts.

Review the evidence and your use of @redhat-cloud-services/frontend-components-config@6.14.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 15:53:31.546Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @redhat-cloud-services

Behavioral surface

Related packages

More from @redhat-cloud-services

Source & flagged code