All @emilgroup/partner-sdk-node versions

@emilgroup/[email protected] rejected Risk: 43 Unlicense

@emilgroup/partner-sdk-node @1.19.0

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Tarball
43
Risk Score
Unlicense
License
No
Install Scripts
3
Dependencies
2
Dev Dependencies
71.8 KB
Package Size
Published

OpenAPI client for @emilgroup/partner-sdk-node

Maintainers

cover42devswojciech_at_emilmaksym-emilyevheniia-emilemil_aleksandravitaly_emilandrii_meleniukiaroslav.ovcharenkohussein.istanboulithomascover42emil-husseinthmdvolodymyr_emilrkachalkazamiulemil-rickmads-emilolga_timchenko

Keywords

axiostypescriptopenapi-clientopenapi-generator@emilgroup/partner-sdk-node

Dependencies (3)

PackageConstraintRegistry Status
url ^0.11.0 auto_approved
axios ^1.12.0 auto_approved
form-data ^4.0.0 auto_approved

Dev Dependencies (2)

PackageConstraintRegistry Status
typescript ^4.0 auto_approved
@types/node ^12.11.5 auto_approved

Transitive Dependency Tree

34 transitive deps max depth 9
  ├─ axios ^1.12.0 → 1.16.0
  ├─ form-data ^4.0.0 → 4.0.5
├─ url ^0.11.0 → 0.11.4
  ├─ asynckit ^0.4.0
  ├─ combined-stream ^1.0.8 → 1.0.8
  ├─ es-set-tostringtag ^2.1.0 → 2.1.0
  ├─ follow-redirects ^1.16.0 → 1.16.0
  ├─ form-data ^4.0.5 → 4.0.5
  ├─ hasown ^2.0.2 → 2.0.4
  ├─ mime-types ^2.1.12 → 2.1.35
  ├─ proxy-from-env ^2.1.0 → 2.1.0
  ├─ punycode ^1.4.1 → 1.4.1
├─ qs ^6.12.3 → 6.15.2
  ├─ asynckit ^0.4.0
  ├─ combined-stream ^1.0.8 → 1.0.8
  ├─ delayed-stream ~1.0.0 → 1.0.0
  ├─ es-errors ^1.3.0 → 1.3.0
  ├─ es-set-tostringtag ^2.1.0 → 2.1.0
  ├─ function-bind ^1.1.2 → 1.1.2
  ├─ get-intrinsic ^1.2.6 → 1.3.1
  ├─ has-tostringtag ^1.0.2 → 1.0.2
  ├─ hasown ^2.0.2 → 2.0.4
  ├─ mime-db 1.52.0
  ├─ mime-types ^2.1.12 → 2.1.35
├─ side-channel ^1.1.0 → 1.1.0
  ├─ async-function ^1.0.0
  ├─ async-generator-function ^1.0.0 → 1.0.0
  ├─ call-bind-apply-helpers ^1.0.2 → 1.0.2
  ├─ delayed-stream ~1.0.0 → 1.0.0
  ├─ es-define-property ^1.0.1 → 1.0.1
  ├─ es-errors ^1.3.0 → 1.3.0
  ├─ es-object-atoms ^1.1.1 → 1.1.2
  ├─ function-bind ^1.1.2 → 1.1.2
  ├─ generator-function ^2.0.0 → 2.0.1
  ├─ get-intrinsic ^1.2.6 → 1.3.1
  ├─ get-proto ^1.0.1
  ├─ gopd ^1.2.0 → 1.2.0
  ├─ has-symbols ^1.1.0 → 1.1.0
  ├─ has-symbols ^1.0.3 → 1.1.0
  ├─ has-tostringtag ^1.0.2 → 1.0.2
  ├─ hasown ^2.0.2 → 2.0.4
  ├─ math-intrinsics ^1.1.0 → 1.1.0
  ├─ mime-db 1.52.0
  ├─ object-inspect ^1.13.3 → 1.13.4
  ├─ side-channel-list ^1.0.0 → 1.0.1
  ├─ side-channel-map ^1.0.1 → 1.0.1
├─ side-channel-weakmap ^1.0.2 → 1.0.2
  ├─ async-function ^1.0.0
  ├─ async-generator-function ^1.0.0 → 1.0.0
  ├─ call-bind-apply-helpers ^1.0.2 → 1.0.2
  ├─ call-bound ^1.0.2 → 1.0.4
  ├─ es-define-property ^1.0.1 → 1.0.1
  ├─ es-errors ^1.3.0 → 1.3.0
  ├─ es-object-atoms ^1.1.1 → 1.1.2
  ├─ function-bind ^1.1.2 → 1.1.2
  ├─ generator-function ^2.0.0 → 2.0.1
  ├─ get-intrinsic ^1.2.5 → 1.3.1
  ├─ get-proto ^1.0.1
  ├─ gopd ^1.2.0 → 1.2.0
  ├─ has-symbols ^1.0.3 → 1.1.0
  ├─ has-symbols ^1.1.0 → 1.1.0
  ├─ hasown ^2.0.2 → 2.0.4
  ├─ math-intrinsics ^1.1.0 → 1.1.0
  ├─ object-inspect ^1.13.4 → 1.13.4
  ├─ object-inspect ^1.13.3 → 1.13.4
├─ side-channel-map ^1.0.1 → 1.0.1
  ├─ async-function ^1.0.0
  ├─ async-generator-function ^1.0.0 → 1.0.0
  ├─ call-bind-apply-helpers ^1.0.2 → 1.0.2
  ├─ call-bound ^1.0.2 → 1.0.4
  ├─ es-define-property ^1.0.1 → 1.0.1
  ├─ es-errors ^1.3.0 → 1.3.0
  ├─ es-object-atoms ^1.1.1 → 1.1.2
  ├─ function-bind ^1.1.2 → 1.1.2
  ├─ generator-function ^2.0.0 → 2.0.1
  ├─ get-intrinsic ^1.3.0 → 1.3.1
  ├─ get-intrinsic ^1.2.5 → 1.3.1
  ├─ get-proto ^1.0.1
  ├─ gopd ^1.2.0 → 1.2.0
  ├─ has-symbols ^1.1.0 → 1.1.0
  ├─ hasown ^2.0.2 → 2.0.4
  ├─ math-intrinsics ^1.1.0 → 1.1.0
├─ object-inspect ^1.13.3 → 1.13.4
  ├─ async-function ^1.0.0
  ├─ async-generator-function ^1.0.0 → 1.0.0
  ├─ call-bind-apply-helpers ^1.0.2 → 1.0.2
  ├─ es-define-property ^1.0.1 → 1.0.1
  ├─ es-errors ^1.3.0 → 1.3.0
  ├─ es-object-atoms ^1.1.1 → 1.1.2
  ├─ function-bind ^1.1.2 → 1.1.2
  ├─ generator-function ^2.0.0 → 2.0.1
  ├─ get-intrinsic ^1.3.0 → 1.3.1
  ├─ get-proto ^1.0.1
  ├─ gopd ^1.2.0 → 1.2.0
  ├─ has-symbols ^1.1.0 → 1.1.0
  ├─ hasown ^2.0.2 → 2.0.4
├─ math-intrinsics ^1.1.0 → 1.1.0
  ├─ async-function ^1.0.0
  ├─ async-generator-function ^1.0.0 → 1.0.0
  ├─ call-bind-apply-helpers ^1.0.2 → 1.0.2
  ├─ es-define-property ^1.0.1 → 1.0.1
  ├─ es-errors ^1.3.0 → 1.3.0
  ├─ es-object-atoms ^1.1.1 → 1.1.2
  ├─ function-bind ^1.1.2 → 1.1.2
  ├─ generator-function ^2.0.0 → 2.0.1
  ├─ get-proto ^1.0.1
  ├─ gopd ^1.2.0 → 1.2.0
  ├─ has-symbols ^1.1.0 → 1.1.0
  ├─ hasown ^2.0.2 → 2.0.4
├─ math-intrinsics ^1.1.0 → 1.1.0
  ├─ es-errors ^1.3.0 → 1.3.0
  ├─ function-bind ^1.1.2 → 1.1.2

SAST Findings (2)

CRITICAL MAL-2026-2055: Malicious code in @emilgroup/partner-sdk-node (npm) osv

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (021998bae85c5300a2c6e776ee80893de174f4216d701951b4742fd3eff21d85) The package @emilgroup/partner-sdk-node was found to contain malicious code. ## Source: ghsa-malware (d0ffdf43c87ac73dfc497be07141d26e73c170b45f0bf8abf32d91ffaa16642e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: google-open-source-security (8c027bf7b7604435dc817eb1ede9097de14221eae0a94d063a58360bc14228eb) This package was compromised by the CanisterWorm campaign by the TeamPCP threat actor. The malicious payload establishes persistence as user systemd service and places a backdoor on the infected host. The malware will also harvest npm credentials and can autonomously spread.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Review Summary

Risk score: 43. Findings: 1 critical (+40), 1 low (+3).

Commit: 2b531fcd82b4

Published to npm: