@sap-ux/abap-deploy-config-sub-generator@1.0.78
Sub generator for ABAP deployment configuration
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe generator’s visible purpose and configuration writes are ordinary, but it automatically sends runtime telemetry after generation without disclosure in its README. The telemetry helper implementation is unavailable, so this is a warning rather than a confirmed data exfiltration finding.
Decision evidence
public snapshot- After deployment configuration generation, the generator automatically calls sendTelemetry with a DEPLOY_CONFIG event, the ABAP target, and inherited telemetryData.
- The README describes configuration generation and installation but does not disclose runtime telemetry.
- The telemetry helper is provided by a dependency whose implementation is not included in this snapshot, so its recipient and payload cannot be verified.
- The package is a Yeoman generator for SAP Fiori ABAP deployment configuration.
- Its visible write path generates deployment configuration from the answers supplied to the generator.
- The manifest contains no install, preinstall, or postinstall lifecycle hook.
Source & flagged code
3 flaggedAfter deployment configuration generation, the generator automatically calls sendTelemetry with a DEPLOY_CONFIG event, the ABAP target, and inherited telemetryData.
generators/app/index.jsView on unpkg · L299The README describes configuration generation and installation but does not disclose runtime telemetry.
Findings
Affected versions and remediation
This report applies to @sap-ux/abap-deploy-config-sub-generator@1.0.78.
See all versions of @sap-ux/abap-deploy-config-sub-generator for other recorded verdicts.
- Review the evidence and your use of @sap-ux/abap-deploy-config-sub-generator@1.0.78 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.