@attabot/complaint-app@1.0.16: Malicious npm security report | LPM Firewall

Loading npm security reports…

@attabot/complaint-app@1.0.16: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/complaint-app.jsView file

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && jr("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && ce(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", ac = br && window.location.href || "http://localhost", oc = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

3794let tt = "https://api-grievance.airaops.com", Oo = null;

High

Ai Review Evidence

The bundle defaults API traffic to an external airaops host.

dist/complaint-app.jsView on unpkg · L3794

3804const Gc = (e) => { tt = e || "", ee.defaults.baseURL = tt; }, ko = (e) => { Oo = e || null; }, Qc = () => Oo || pt.get("token") || null, ee = X.create({ baseURL: tt, headers: { Accept: "application/json", "Content-Type": "application/json" } }); ee.interceptors.request.use((e) => { const t = Qc(); return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e; });

High

Ai Review Evidence

It attaches an in-memory or cookie token as a Bearer credential on every API request.

dist/complaint-app.jsView on unpkg · L3804

4192}), yt = fe( "complaintType/fetchAll", async (e, t) => { try { const n = await ee.get(Ut); return console.log("[fetchComplaintTypes] API response:", n.data), n.data;

High

Ai Review Evidence

Mounting the complaint-management UI automatically fetches complaint types through that client.

dist/complaint-app.jsView on unpkg · L4192

5459Z(() => { u(pn({ data: !1 })), u(yt()); }, [u]);

High

Ai Review Evidence

Mounting the complaint-management UI automatically fetches complaint types through that client.

dist/complaint-app.jsView on unpkg · L5459

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

Source & flagged code

6 flagged

dist/complaint-app.jsView file

Lines 3774-3824javascript

3774 zt({}, o, {

3775 expires: -1

3776 })

3777 );

3778 },

3779 withAttributes: function(a) {

3780 return tr(this.converter, zt({}, this.attributes, a));

3781 },

3782 withConverter: function(a) {

3783 return tr(zt({}, this.converter, a), this.attributes);

3784 }

3785 },

3786 {

3787 attributes: { value: Object.freeze(t) },

3788 converter: { value: Object.freeze(e) }

3789 }

3790 );

3791}

3792var pt = tr(Xc, { path: "/" });

3793const Yc = { BASE_URL: "/", DEV: !1, MODE: "production", PROD: !0, SSR: !1 };

3794let tt = "https://api-grievance.airaops.com", Oo = null;

High

Ai Review Evidence

The bundle defaults API traffic to an external airaops host.

dist/complaint-app.jsView on unpkg · L3794

3795try {

3796 if (typeof import.meta < "u" && Yc?.VITE_API_URL)

3797 tt = void 0;

3798 else {

3799 const e = typeof process < "u" ? process : null;

3800 e?.env?.VITE_API_URL && (tt = e.env.VITE_API_URL);

3801 }

3802} catch {

3803}

3804const Gc = (e) => {

3805 tt = e || "", ee.defaults.baseURL = tt;

3806}, ko = (e) => {

3807 Oo = e || null;

3808}, Qc = () => Oo || pt.get("token") || null, ee = X.create({

3809 baseURL: tt,

3810 headers: {

3811 Accept: "application/json",

3812 "Content-Type": "application/json"

3813 }

3814});

3815ee.interceptors.request.use((e) => {

High

Ai Review Evidence

It attaches an in-memory or cookie token as a Bearer credential on every API request.

dist/complaint-app.jsView on unpkg · L3804

3816 const t = Qc();

3817 return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e;

3818});

3819let On = !1, kn = null;

3820ee.interceptors.response.use(

3821 (e) => e,

3822 async (e) => {

3823 const t = e.config, n = e.response;

3824 if (n && (n.status === 401 || n.status === 402)) {

Lines 4172-4212javascript

4172 }).addCase(tn.fulfilled, (t) => {

4173 t.formFields.isMutating = !1;

4174 }).addCase(tn.rejected, (t, n) => {

4175 t.formFields.isMutating = !1, t.formFields.error

Lines 5439-5479javascript

5439 formsFilled: 312,

5440 updatedOn: "20 Mar 2024"

5441 }

5442], Pu = "Create, manage and track complaint forms, workflows and responses across departments.";

5443function Mu({

5444 title: e

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && jr("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && ce(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", ac = br && window.location.href || "http://localhost", oc = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg