@tsed/swagger@8.44.11
Swagger package for Ts.ED framework
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe transitive swagger-ui-dist dependency documents default-on installation analytics through Scarf, with opt-out instead of opt-in. Under the install-time contact rule, that undisabled install-time network behavior warrants blocking.
Static reason
No blocking static signals were detected.
Trigger
Installing @tsed/swagger and its dependencies.
Impact
Installation activity and associated analytics are disclosed to an analytics service unrelated to serving Swagger UI.
Mechanism
swagger-ui-dist declares @scarf/scarf and documents that Scarf collects installation analytics during installation; the documented opt-out is not enabled by default.
Attack narrative
Installing this package includes swagger-ui-dist, which depends on @scarf/scarf. swagger-ui-dist documents that Scarf installation analytics run during installation unless the consuming project opts out. This creates default install-time contact with an analytics service unrelated to Swagger UI; the available evidence does not establish the exact payload.
AI rationale
The transitive swagger-ui-dist dependency documents default-on installation analytics through Scarf, with opt-out instead of opt-in. Under the install-time contact rule, that undisabled install-time network behavior warrants blocking.
Evidence
package.json.lpm-dependency-evidence-f3194b2e-5def-431e-a9af-41e9db28567a/2/npm-linux/package.json.lpm-dependency-evidence-f3194b2e-5def-431e-a9af-41e9db28567a/2/npm-linux/README.md
Network endpoints1
scarf.sh
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package declares swagger-ui-dist as a runtime dependency.
- The included swagger-ui-dist package declares @scarf/scarf as a dependency.
- swagger-ui-dist documents installation analytics collected through Scarf, run during installation by default, with an opt-out setting.
Evidence against
- The analytics are disclosed as anonymized and can be disabled through scarfSettings.enabled in the consuming project's package.json.
- The package's own scripts are build, test, and development commands; it declares no lifecycle hook.
Behavioral surface
Source & flagged code
4 flaggedpackage.jsonView file
28"dependencies": {
"@tsed/normalize-path": "8.44.11",
"@tsed/openapi-utils": "8.44.11",
"@tsed/openspec": "8.44.11",
"swagger-ui-dist": ">=5.17.14",
"tslib": ">=2.7.0"
},
"devDependencies": {
"@tsed/barrels": "8.44.11",
High
Suspicious Dependency Evidence
The package declares swagger-ui-dist as a runtime dependency.
package.jsonView on unpkg · L2818"scripts": {
"clean": "rm -rf lib",
"build": "yarn clean && yarn barrels && yarn build:ts && yarn copy:views",
"copy:views": "cp -r ./views ./lib/views",
"barrels": "barrels",
"start": "node --import @swc-node/register/esm-register test/app/index.ts",
"test": "vitest run",
"build:ts": "tsc --build
High
Ai Review Evidence
swagger-ui-dist documents installation analytics collected through Scarf, run during installation by default, with an opt-out setting.
package.jsonView on unpkg · L18.lpm-dependency-evidence-f3194b2e-5def-431e-a9af-41e9db28567a/2/npm-linux/package.jsonView file
Findings
4 High1 Low
HighSuspicious Dependency Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-f3194b2e-5def-431e-a9af-41e9db28567a/2/npm-linux/package.json
HighAi Review Evidence.lpm-dependency-evidence-f3194b2e-5def-431e-a9af-41e9db28567a/2/npm-linux/README.md
HighAi Review Evidencepackage.json
LowScripts Present
Affected versions and remediation
This report applies to @tsed/swagger@8.44.11.
See all versions of @tsed/swagger for other recorded verdicts.
- Avoid installing @tsed/swagger@8.44.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.