@attabot/complaint-app: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@attabot/complaint-app: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/complaint-app.jsView file

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && Ia("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && Te(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", Td = da && window.location.href || "http://localhost", Rd = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

3794ttps://api-grievance.airaops.com", Do = null; try { if (typeof import.meta < "u" && Su?.VITE_API_URL) Et = void 0; else { const e = typeof process < "u" ? process : null; e?.env?.VITE_API_URL && (Et = e.env.VITE_API_URL); } } catch { } const Cu = (e) => { Et = e || "", ce.defaults.baseURL = Et; }, Po = (e) => { Do = e || null; }, Nu = () => Do || Mt.get("token") || null, ce = de.create({ baseURL: Et, headers: { Accept: "application/json", "Content-Type": "application/json" } });

Medium

Ai Review Evidence

The library uses an API base URL for its complaint service and allows the caller to configure it.

dist/complaint-app.jsView on unpkg · L3794

3812son" } }); ce.interceptors.request.use((e) => { const t = Nu(); return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e; }); let yr = !1, br = null; ce.interceptors.response.use( (e) => e, async (e) => { const t = e.

Medium

Ai Review Evidence

The request interceptor sends the selected token as a bearer credential with API requests.

dist/complaint-app.jsView on unpkg · L3812

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

1.field-options-panel{box-sizing:border-box;display:flex;flex-direction:column;width:246px;min-width:246px;min-height:462px;padding:10px;border:1px solid var(--ca-accent-b

Medium

Ai Review Evidence

The required stylesheet excerpt contains component presentation rules.

dist/style.cssView on unpkg · L1

package.jsonView file

21"scripts": { "dev": "vite", "build": "vite build", "lint": "eslint .", "preview": "vite preview" }, "keywords": [ "react", "complaint", "component

Medium

Suspicious Lifecycle Evidence

package.json defines development and build scripts but no install lifecycle hook.

package.jsonView on unpkg · L21

Source & flagged code

6 flagged

dist/complaint-app.jsView file

Lines 3774-3832javascript

3774 yn({}, s, {

3775 expires: -1

3776 })

3777 );

3778 },

3779 withAttributes: function(a) {

3780 return Wr(this.converter, yn({}, this.attributes, a));

3781 },

3782 withConverter: function(a) {

3783 return Wr(yn({}, this.converter, a), this.attributes);

3784 }

3785 },

3786 {

3787 attributes: { value: Object.freeze(t) },

3788 converter: { value: Object.freeze(e) }

3789 }

3790 );

3791}

3792var Mt = Wr(vu, { path: "/" });

3793const Su = { BASE_URL: "/", DEV: !1, MODE: "production", PROD: !0, SSR: !1 };

3794let Et = "https://api-grievance.airaops.com", Do = null;

3795try {

3796 if (typeof import.meta < "u" && Su?.VITE_API_URL)

3797 Et = void 0;

3798 else {

3799 const e = typeof process < "u" ? process : null;

3800 e?.env?.VITE_API_URL && (Et = e.env.VITE_API_URL);

3801 }

3802} catch {

3803}

3804const Cu = (e) => {

3805 Et = e || "", ce.defaults.baseURL = Et;

Medium

Ai Review Evidence

The library uses an API base URL for its complaint service and allows the caller to configure it.

dist/complaint-app.jsView on unpkg · L3794

3806}, Po = (e) => {

3807 Do = e || null;

3808}, Nu = () => Do || Mt.get("token") || null, ce = de.create({

3809 baseURL: Et,

3810 headers: {

3811 Accept: "application/json",

3812 "Content-Type": "application/json"

3813 }

3814});

3815ce.interceptors.request.use((e) => {

3816 const t = Nu();

3817 return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e;

3818});

3819let yr = !1, br = null;

3820ce.interceptors.response.use(

3821 (e) => e,

3822 async (e) => {

3823 const t = e.config, n = e.response;

Medium

Ai Review Evidence

The request interceptor sends the selected token as a bearer credential with API requests.

dist/complaint-app.jsView on unpkg · L3812

3824 if (n && (n.status === 401 || n.status === 402)) {

3825 const r = Mt.get("refreshToken");

3826 if (r)

3827 try {

3828 yr || (yr = !0, br = de.post(

3829 `${Et}/api/v1/auth/refresh`,

3830 {},

3831 {

3832 headers: {

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && Ia("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && Te(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", Td = da && window.location.href || "http://localhost", Rd = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

dist/style.cssView file

Lines 1-2text

1.field-options-panel{box-sizing:border-box;display:flex;flex-direction:column;width:246px;min-width:246px;min-height:462px;padding:10px;border:1px solid var(--ca-accent-border, #78a9f7);border-radius:10px;background:var(--ca-surface, #fff);color:var(--ca-text, #111827)}.field-options-panel__summary{display:flex;width:100%;align-items:flex-start;justify-content:space-between;gap:8px;padding:0 0 8px;border:0;background:transparent;color:inherit;font:inherit;text-align:left;cursor:default}.field-options-panel__summary-text{display:flex;min-width:0;flex:1;flex-direction:column}.field-options-panel ...

Medium

Ai Review Evidence

The required stylesheet excerpt contains component presentation rules.

dist/style.cssView on unpkg · L1

2

Long lines were clipped for display.

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

package.jsonView file

Lines 1-41json

1{

2 "name": "@attabot/complaint-app",

3 "version": "1.0.34",

4 "description": "Complaint Management UI package — atomic React components that run on the parent app's auth and API",

5 "type": "module",

6