registry / @savvycal/appointments-core / 2.0.0

@savvycal/appointments-core@2.0.0

JavaScript/TypeScript client library for the SavvyCal Appointments API

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 45.4 KB of source, external domains: api.savvycal.app

Source & flagged code

1 flagged

dist/index.cjsView file

Lines 129-169javascript

129 syncConnectedAccountExternalUsers: () => syncConnectedAccountExternalUsers,

130 syncServiceConferencing: () => syncServiceConferencing,

131 updateAccount: () => updateAccount,

132 updateAccountUser: () => updateAccountUser,

133 updateBlock: () =>

Source & flagged code

1 flagged · loading source

dist/index.cjsView file

149package = @savvycal/appointments-core; repositoryIdentity = appointments; dependency = openapi-fetch L149: // src/client.ts L150: var import_openapi_fetch = __toESM(require("openapi-fetch"), 1); L151: var DEFAULT_BASE_URL = "https://api.savvycal.app";

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.cjsView on unpkg · L149

Findings

1 High1 Medium2 Low

HighCopied Package Dependency Bridgedist/index.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings