registry / @taskmagic/pieces-common / 0.4.4

@taskmagic/pieces-common@0.4.4

This library was generated with [Nx](https://nx.dev).

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Runtime HTTP calls disable TLS certificate verification globally. No install-time behavior or confirmed data-harvesting chain was found.

Static reason

No blocking static signals were detected.

Trigger

A consumer invokes AxiosHttpClient.sendRequest or a helper that uses it.

Impact

A network attacker may intercept or alter otherwise HTTPS-protected runtime traffic.

Mechanism

process-global TLS verification bypass during HTTP requests

Rationale

The package is not shown to be malicious, but its unconditional TLS-verification bypass is an unresolved runtime security vulnerability. Flag for warning rather than publication block.

Evidence

package.jsonsrc/index.jssrc/lib/http/axios/axios-http-client.jssrc/lib/ai/index.jssrc/lib/ai/providers/index.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

src/lib/http/axios/axios-http-client.js disables NODE_TLS_REJECT_UNAUTHORIZED for every request.
The TLS setting is process-global and permits interception of runtime API traffic.

@taskmagic/pieces-common@0.4.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code