registry / @stackfactor/client-api / 1.1.249

@stackfactor/client-api@1.1.249

Node.js library for the StackFactor API

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a StackFactor API client with user-invoked HTTP and websocket calls; suspicious dependency/env patterns appear package-aligned or unused.

Static reason

One or more suspicious static signals were detected.

Trigger

importing the library initializes config; exported API functions perform network calls when invoked by the user

Impact

No unauthorized file, credential, persistence, destructive, or lifecycle execution behavior found in inspected source.

Mechanism

API client wrappers over axios and socket.io

Rationale

Static inspection shows a conventional generated API client; network use is expected and user/API-token driven, with no install-time execution or concrete exfiltration path. The unused builtin-name dependency and dotenv import-time config read are quality/supply-chain concerns but do not make this package version malicious.

Evidence

package.jsondist/esm/lib/index.jsdist/cjs/lib/index.jsdist/esm/lib/utils.jsdist/esm/lib/axiosClient.jsdist/esm/lib/integration.js.envdist/esm/package.jsondist/cjs/package.json

Network endpoints6

localhostqaapi.stackfactor.aiapiqa.stackfactor.ai

@stackfactor/client-api@1.1.249

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code