@attabot/complaint-app@1.0.24: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@attabot/complaint-app@1.0.24: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/complaint-app.jsView file

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && Ca("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && we(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", nd = Qr && window.location.href || "http://localhost", rd = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

3794https://api-grievance.airaops.com", wi = null; try { if (typeof import.meta < "u" && Zd?.VITE_API_URL) bt = void 0; else { const e = typeof process < "u" ? process : null; e?.env?.VITE_API_URL && (bt = e.env.VITE_API_URL); } } catch { } const Gd = (e) => { bt = e || "", ae.defaults.baseURL = bt; }, vi = (e) => { wi = e || null; }, Yd = () => wi || Rt.get("token") || null, ae = se.create({ baseURL: bt, headers: { Accept: "application/json", "Content-Type": "application/json" } }); ae.interceptors.request.use((e) => { const t = Yd(); re

Medium

Ai Review Evidence

The package permits its API base URL to be replaced at runtime.

dist/complaint-app.jsView on unpkg · L3794

3816d(); return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e; }); let dr = !1, ur = null; ae.interceptors.response.use

Medium

Ai Review Evidence

Its request interceptor falls back to an existing token cookie and adds that token as a bearer credential.

dist/complaint-app.jsView on unpkg · L3816

4110, (e, { signal: t }) => ae.get(na.formFields(e), { signal: t }) ), En = ra( "complaint/types/saveFormFields", ({ complaintTypeId: e, data: t }) => ae.put(na.formFields(e), t)

Medium

Ai Review Evidence

UI data operations send requests through that configured client.

dist/complaint-app.jsView on unpkg · L4110

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

package.jsonView file

21"scripts": { "dev": "vite", "build": "vite build", "lint": "eslint .", "preview": "vite preview" }, "keywords": [ "react", "complaint", "component

Medium

Suspicious Lifecycle Evidence

The manifest lists development scripts only and no install lifecycle hook.

package.jsonView on unpkg · L21

Source & flagged code

6 flagged

dist/complaint-app.jsView file

Lines 3774-3836javascript

3774 pn({}, s, {

3775 expires: -1

3776 })

3777 );

3778 },

3779 withAttributes: function(a) {

3780 return Pr(this.converter, pn({}, this.attributes, a));

3781 },

3782 withConverter: function(a) {

3783 return Pr(pn({}, this.converter, a), this.attributes);

3784 }

3785 },

3786 {

3787 attributes: { value: Object.freeze(t) },

3788 converter: { value: Object.freeze(e) }

3789 }

3790 );

3791}

3792var Rt = Pr(Jd, { path: "/" });

3793const Zd = { BASE_URL: "/", DEV: !1, MODE: "production", PROD: !0, SSR: !1 };

3794let bt = "https://api-grievance.airaops.com", wi = null;

3795try {

3796 if (typeof import.meta < "u" && Zd?.VITE_API_URL)

3797 bt = void 0;

3798 else {

3799 const e = typeof process < "u" ? process : null;

3800 e?.env?.VITE_API_URL && (bt = e.env.VITE_API_URL);

3801 }

3802} catch {

3803}

3804const Gd = (e) => {

3805 bt = e || "", ae.defaults.baseURL = bt;

Medium

Ai Review Evidence

The package permits its API base URL to be replaced at runtime.

dist/complaint-app.jsView on unpkg · L3794

3806}, vi = (e) => {

3807 wi = e || null;

3808}, Yd = () => wi || Rt.get("token") || null, ae = se.create({

3809 baseURL: bt,

3810 headers: {

3811 Accept: "application/json",

3812 "Content-Type": "application/json"

3813 }

3814});

3815ae.interceptors.request.use((e) => {

3816 const t = Yd();

3817 return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e;

3818});

3819let dr = !1, ur = null;

3820ae.interceptors.response.use(

Medium

Ai Review Evidence

Its request interceptor falls back to an existing token cookie and adds that token as a bearer credential.

dist/complaint-app.jsView on unpkg · L3816

3821 (e) => e,

3822 async (e) => {

3823 const t = e.config, n = e.response;

3824 if (n && (n.status === 401 || n.status === 402)) {

3825 const r = Rt.get("refreshToken");

3826 if (r)

3827 try {

3828 dr || (dr = !0, ur = se.post(

3829 `${bt}/api/v1/auth/refresh`,

3830 {},

3831 {

3832 headers: {

3833 Authorization: `Bearer ${r}`

3834 }

3835 }

3836 ));

Lines 4090-4130javascript

4090 // departments: '/api/v1/complaints/departments',

4091 // departmentTree: '/api/v1/complaints/departments/tree',

4092 // priorities: '/api/v1/complaints/priorities',

4093 // workflows: '/api/v1/complaints/workflows',

4094 // workflowSteps: '/api/v1/complaints/workflows/steps',

4095 // statuses: '/api/v1/complaints/statuses',

4096 formFields: (e) => `/api/v1/complaint-types/${

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && Ca("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && we(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", nd = Qr && window.location.href || "http://localhost", rd = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

package.jsonView file

Lines 1-41json

1{

2 "name": "@attabot/complaint-app",

3 "version": "1.0.24",

4 "description": "Complaint Management UI package — atomic React components that run on the parent app's auth and API",

5 "type": "module",

6