registry / @redhat-cloud-services/tsc-transform-imports / 1.3.12

@redhat-cloud-services/tsc-transform-imports@1.3.12

TypeScript compiler transform for optimizing imports in Red Hat Cloud Services projects.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

The manifest has no lifecycle scripts, and the inspected runtime code performs local import transformation. The environment-variable reference only extends local search roots; no concrete attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

The transformer runs when a consumer invokes it through the package entrypoint.

Impact

No credential access, external communication, destructive action, or persistence was identified.

Mechanism

It searches local package directories and rewrites matching import declarations.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares no package scripts and identifies index.js as the CommonJS entrypoint.
index.js imports TypeScript, filesystem, glob, and local path-resolution helpers; its transformer visits source nodes and rewrites matching PatternFly imports.
directories.js reads MODULES_ROOT to add PatternFly package search directories; it performs local glob searches and makes no network request.
The inspected glob manifest shows maintenance and build scripts, and its CommonJS entry exports glob traversal functions.

Evidence against

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 20.1 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 2-24json

2 "name": "@redhat-cloud-services/tsc-transform-imports",

3 "version": "1.3.12",

4 "description": "TypeScript compiler transform for optimizing imports in Red Hat Cloud Services projects.",

5 "main": "index.js",

6 "types": "index.d.ts",

7 "dependencies": {

8 "glob": "10.5.0"

9 },

10 "peerDependencies": {

11 "typescript": "^5.9.3"

12 },

13 "repository": {

14 "type": "git",

15 "url": "git+https://github.com/RedHatInsights/frontend-components.git"

16 },

17 "license": "Apache-2.0",

18 "bugs": {

19 "url": "https://github.com/RedHatInsights/frontend-components/issues"

20 },

21 "homepage": "https://github.com/RedHatInsights/frontend-components/tree/master/packages/tsc-transform-imports#readme",

22 "scripts": {},

23 "type": "commonjs"

24}

Low

Ai Review Evidence

package.json declares no package scripts and identifies index.js as the CommonJS entrypoint.

package.jsonView on unpkg · L22

index.jsView file

Lines 19-59javascript

19 var ownKeys = function(o) {

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

directories.jsView file

Lines 23-66javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod &&

.lpm-dependency-evidence-dbf2c24d-b322-45e4-97a1-9a66ec7c07eb/0/npm-linux/package.jsonView file

40"scripts": { "preversion": "npm test", "postversion": "npm publish", "prepublishOnly": "git push origin --follow-tags", "prepare": "tshy", "pretest": "npm run prepare", "presnap": "npm run prepare", "test": "tap", "snap": "tap", "format": "prettier --write . --log-level warn", "typedoc": "typedoc --tsconfig .tshy/esm.json ./src/*.ts", "prepublish": "np

Low

Ai Review Evidence

The inspected glob manifest shows maintenance and build scripts, and its CommonJS entry exports glob traversal functions.

.lpm-dependency-evidence-dbf2c24d-b322-45e4-97a1-9a66ec7c07eb/0/npm-linux/package.jsonView on unpkg · L40

.lpm-dependency-evidence-dbf2c24d-b322-45e4-97a1-9a66ec7c07eb/0/npm-linux/dist/commonjs/index.jsView file

27function globSync(pattern, options = {}) { return new glob_js_1.Glob(pattern, options).walkSync(); } async function glob_(pattern, options = {}) { return new glob_js_1.Glob

Low

Ai Review Evidence

The inspected glob manifest shows maintenance and build scripts, and its CommonJS entry exports glob traversal functions.

.lpm-dependency-evidence-dbf2c24d-b322-45e4-97a1-9a66ec7c07eb/0/npm-linux/dist/commonjs/index.jsView on unpkg · L27

Source & flagged code

7 flagged · loading source

package.jsonView file

22"scripts": {}, "type": "commonjs" }

Low

Ai Review Evidence

package.json declares no package scripts and identifies index.js as the CommonJS entrypoint.

package.jsonView on unpkg · L22

index.jsView file

39var ts = __importStar(require("typescript")); var fs = __importStar(require("fs")); var glob = __importStar(require("glob")); var directories_1 = require("./directories"); var gues

Low

Ai Review Evidence

index.js imports TypeScript, filesystem, glob, and local path-resolution helpers; its transformer visits source nodes and rewrites matching PatternFly imports.

index.jsView on unpkg · L39

203return ts.visitNode(rootNode, visitor); }; }; exports.default = transformer; //# sourceMappingURL=index.js.map

Low

Ai Review Evidence

index.js imports TypeScript, filesystem, glob, and local path-resolution helpers; its transformer visits source nodes and rewrites matching PatternFly imports.

Findings

1 Medium8 Low

MediumEnvironment Vars

LowFilesystem

LowAi Review Evidencepackage.json

LowAi Review Evidenceindex.js

LowAi Review Evidencedirectories.js

LowAi Review Evidence.lpm-dependency-evidence-dbf2c24d-b322-45e4-97a1-9a66ec7c07eb/0/npm-linux/package.json

LowAi Review Evidence.lpm-dependency-evidence-dbf2c24d-b322-45e4-97a1-9a66ec7c07eb/0/npm-linux/dist/commonjs/index.js

Affected versions and remediation

This report applies to @redhat-cloud-services/tsc-transform-imports@1.3.12.

See all versions of @redhat-cloud-services/tsc-transform-imports for other recorded verdicts.

Review the evidence and your use of @redhat-cloud-services/tsc-transform-imports@1.3.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 09:13:36.970Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @redhat-cloud-services

Behavioral surface

Related packages

More from @redhat-cloud-services

Source & flagged code