Loading npm security reports…
Complaint Management UI package — atomic React components that run on the parent app's auth and API
The package sends host authentication credentials and complaint form data to hard-coded Airaops endpoints. One endpoint bypasses the consumer-provided API base URL.
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/complaint-app.umd.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/style.cssView on unpkgThe client defaults to a hard-coded external API host.
dist/complaint-app.jsView on unpkg · L3794It reads a token cookie and attaches it as a bearer credential to requests.
dist/complaint-app.jsView on unpkg · L3808A roles request uses a separate hard-coded Airaops URL through that authenticated client, bypassing the supplied API URL.
dist/complaint-app.jsView on unpkg · L4475This report applies to @attabot/complaint-app@1.0.13.
See version security history for other recorded verdicts.
Evidence last updated: .
Complaint form field values are posted through the same client.
dist/complaint-app.jsView on unpkg · L7933Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/complaint-app.umd.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/style.cssView on unpkgThe client defaults to a hard-coded external API host.
dist/complaint-app.jsView on unpkg · L3794It reads a token cookie and attaches it as a bearer credential to requests.
dist/complaint-app.jsView on unpkg · L3808A roles request uses a separate hard-coded Airaops URL through that authenticated client, bypassing the supplied API URL.
dist/complaint-app.jsView on unpkg · L4475Complaint form field values are posted through the same client.
dist/complaint-app.jsView on unpkg · L7933