kubb@5.14.1
⚠ Under reviewTurn your API spec into type-safe code. Generate TypeScript types, API clients, hooks, validators and mocks from a spec such as OpenAPI.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe inspected entrypoints delegate runtime behavior to dependencies whose source is unresolved, including @kubb/core, which is imported by both the public API and CLI. No attack was confirmed, but the unresolved runtime source prevents a clean verdict.
Static reason
No blocking static signals were detected.
Trigger
Importing the public runtime entrypoint or running the kubb command.
Impact
No attack impact was confirmed; behavior in unavailable dependency source could not be assessed.
Mechanism
The entrypoints delegate runtime work to @kubb/core and @kubb/cli, whose full behavior was not resolved here.
AI rationale
The inspected entrypoints delegate runtime behavior to dependencies whose source is unresolved, including @kubb/core, which is imported by both the public API and CLI. No attack was confirmed, but the unresolved runtime source prevents a clean verdict.
Evidence
package.jsonbin/kubb.jsdist/index.js.lpm-dependency-evidence-acf98c5a-9e1a-4511-98f8-8eae3d83ba27/0/npm-linux/dist/index.js
Decision evidence
public snapshotAI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package depends on several Kubb runtime packages at version 5.14.1, including @kubb/core.
- The command line entrypoint passes user-supplied arguments to @kubb/cli.
- The public runtime entrypoint imports createKubb from @kubb/core.
- The inspected CLI source also imports multiple runtime functions from @kubb/core.
Evidence against
- No concrete attack behavior was established in the inspected entrypoints; the imported @kubb/core implementation and other dependencies with unresolved source remain unassessed.
Behavioral surface
Source & flagged code
4 flaggedpackage.jsonView file
170"dependencies": {
"@kubb/adapter-oas": "5.14.1",
"@kubb/cli": "5.14.1",
"@kubb/core": "5.14.1",
"@kubb/kit": "5.14.1",
"@kubb/mcp": "5.14.1",
"@kubb/parser-
Low
Ai Review Evidence
The package depends on several Kubb runtime packages at version 5.14.1, including @kubb/core.
package.jsonView on unpkg · L170bin/kubb.jsView file
7const { run } = await import('@kubb/cli')
await run(process.argv.slice(2))
} catch (err) {
console.error(err)
process.exit(1)
}
Low
Ai Review Evidence
The command line entrypoint passes user-supplied arguments to @kubb/cli.
bin/kubb.jsView on unpkg · L7dist/index.jsView file
2import { createKubb as createKubb$1 } from "@kubb/core";
//#region src/createKubb.ts
/**
* Creates a Kubb instance with the same defaults as `defineConfig`.
*/
function createKubb(
Findings
5 Low
LowScripts Present
LowAi Review Evidencepackage.json
LowAi Review Evidencebin/kubb.js
LowAi Review Evidencedist/index.js
LowAi Review Evidence.lpm-dependency-evidence-acf98c5a-9e1a-4511-98f8-8eae3d83ba27/0/npm-linux/dist/index.js
Affected versions and remediation
This report applies to kubb@5.14.1.
See all versions of kubb for other recorded verdicts.
- Review the evidence and your use of kubb@5.14.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.