Is @microsoft/teams.apps safe?

The component writes or deletes files on disk.

await (0, promises_1.writeFile)(path, this.bytes, { signal: options?.signal });

const writable = (0, fs_1.createWriteStream)(path);

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component makes outbound network requests.

const axios_1 = require("axios");

return fromFetchResponse(await options.fetch(url, {

import http from 'http';

const http_1 = __importDefault(require("http"));

const axios_1 = require("axios");

if ((0, axios_1.isAxiosError)(err) && err.response?.status === 409 && err.response.data?.error?.code === 'PlanConflict') {

import { AxiosError } from 'axios';

const axios_1 = require("axios");

const axios_1 = require("axios");

import http from 'http';

const http_1 = __importDefault(require("http"));

import { AxiosError } from 'axios';

const axios_1 = require("axios");

{ regex: /fetch\(\s*["']([^"']+)["']/gi, source: 'fetch()' },

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (3 occurrence(s) shown as evidence).

const msal_node_1 = require("@azure/msal-node");

this._msalLogger = this.logger.child('azure/msal-node', {

pattern: '-azure/msal-node'

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.