api-platform / api-platform/create-client

[potential Security Alert] New `test-react-app` script added in `@api-platform/client-generator@0.8.0`

未關閉
#394 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
TypeScript
星號
376
分支
132
PR 合併指標
30 天內沒有已合併 PR

描述

A new `test-react-app` script was detected in version `0.8.0` of the package `@api-platform/client-generator`.

**Suspicion Score:** 11/100

**Script content:**
```
rm -rf ./tmp/app && mkdir -p ./tmp/app && yarn create react-app --template typescript ./tmp/app/reactapp && yarn --cwd ./tmp/app/reactapp add react-router-dom react-hook-form && cp -R ./tmp/react/* ./tmp/app/reactapp/src && cp ./templates/react/index.tsx ./tmp/app/reactapp/src && start-server-and-test 'BROWSER=none yarn --cwd ./tmp/app/reactapp start' http://127.0.0.1:3000/books/ 'yarn playwright test'
```
see [npm documentation on package scripts](https://docs.npmjs.com/cli/v9/using-npm/scripts) for more details.
and [the detector](https://github.com/alphaleadership/npm-check). to understand why this script might be dangerous.
to get the alert only for dangerous scripts, please visit[the telegram](https://t.me/npmalert) if you want to improve the algorythm open a pull request
This could be a security risk. Please investigate.

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。