@attabot/complaint-app@1.0.2

High-risk behavior combination matched malicious policy.

Render ComplaintApp with authToken and systemsEndpoint but without apiUrl.

Credential exposure and complaint-data exfiltration to the external receiver.

Hardcoded Axios base URL plus automatic bearer-token forwarding.

The package defaults its API client to api-grievance.airaops.com, stores the parent-provided auth token, and adds it to every client request. Rendering with systemsEndpoint activates a request through that client; if the host omits apiUrl, the request and bearer token go to the hardcoded external host. The same client also sends a refresh-token cookie there after authentication failures.

The package contains a concrete, package-controlled external receiver for parent credentials despite documentation claiming parent-controlled API routing. This is a credential-exfiltration path, not merely bundled Axios behavior.