registry / sap-ai-dev-toolkit / 0.3.1

sap-ai-dev-toolkit@0.3.1

⚠ Under review

SAP AI development toolkit for BAS, ABAP, RAP, CAP, Fiori, UI5, and MCP

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 192 KB of source, external domains: 127.0.0.1, cf-api.invalid, demo.dest, github.com, go.dev

Source & flagged code

8 flagged

package.jsonView file

Lines 1-39json

2 "name": "sap-ai-dev-toolkit",

3 "version": "0.3.1",

4 "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, Fiori, UI5, and MCP",

5 "author": "Gurkan Yilmaz",

6 "type": "module",

7 "engines": {

8 "node": ">=20"

9 },

10 "dependencies": {

11 "@abaplint/core": "2.119.0",

12 "terminal-kit": "^3.1.4",

13 "undici": "^6.21.3"

14 },

15 "bin": {

16 "sap-ai-dev": "src/launcher.mjs"

17 },

18 "scripts": {

19 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "test": "node --test test/*.test.mjs",

21 "test:visibility": "node --test test/setup.test.mjs test/terminal-ui.test.mjs",

22 "test:mutation": "node scripts/mutation-terminal-ui.mjs",

23 "publish:npm": "node scripts/publish-npm.mjs",

24 "ensure:go": "node scripts/ensure-go.mjs",

25 "build:vsp": "node scripts/build-vsp.mjs"

26 },

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/grknylmz/sap-ai-dev-toolkit.git"

30 },

31 "homepage": "https://github.com/grknylmz/sap-ai-dev-toolkit#readme",

32 "bugs": {

33 "url": "https://github.com/grknylmz/sap-ai-dev-toolkit/issues"

34 },

35 "license": "MIT",

36 "files": [

37 "src/",

38 "scripts/",

39 "patches/",

scripts/ensure-go.mjsView file

Lines 1-36javascript

1import { createHash } from 'node:crypto';

2import { execFile, spawnSync } from 'node:child_process';

3import { chmod, mkdir, rm, symlink, writeFile } from 'node:fs/promises';

High

Child Process

Package source references child process execution.

scripts/ensure-go.mjsView on unpkg · L1

scripts/publish-npm.mjsView file

Lines 29-69javascript

29 envFile = await readFile(join(root, '.env'), 'utf8');

30 } catch (error) {

31 if (error?.code !== 'ENOENT') throw error;

dist/vsp-linux-x64View file

•path = dist/vsp-linux-x64 kind = native_binary sizeBytes = 24371360 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vsp-linux-x64View on unpkg

scripts/postinstall.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/postinstall.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•

sap-ai-dev-toolkit@0.3.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code