@attabot/complaint-app@1.0.30: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@attabot/complaint-app@1.0.30: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/complaint-app.jsView file

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && ka("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && Ae(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", _d = la && window.location.href || "http://localhost", Nd = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

3804const yu = (e) => { At = e || "", oe.defaults.baseURL = At; }, Oi = (e) => { Ri = e || null; }, bu = () => Ri || Bt.get("token") || null, oe = ce.create({ baseURL: At, headers: { Accept: "application/json",

Medium

Ai Review Evidence

The API client falls back to the browser token cookie when no caller token is supplied.

dist/complaint-app.jsView on unpkg · L3804

3754for (var s = document.cookie ? document.cookie.split("; ") : [], i = {}, o = 0; o < s.length; o++) { var c = s[o].split("="), d = c.slice(1).join("="); try { var u = de

Medium

Ai Review Evidence

The API client falls back to the browser token cookie when no caller token is supplied.

dist/complaint-app.jsView on unpkg · L3754

3848const wu = tn(null), vu = ({ children: e, apiUrl: t, authToken: n }) => (t && yu(t), Oi(n || null), /* @__PURE__ */ l(wu.Provider, { value: { apiUrl: t, authToken: n }, children: e })), Ge = { mode: "light",

Medium

Ai Review Evidence

The exported URL setter and provider accept an API destination without a destination allowlist.

dist/complaint-app.jsView on unpkg · L3848

10463On as saveFormFields, ju as setAppDetails, Oi as setAuthToken, yu as setBaseUrl, Tt as setId, Hn as setIsEdit, rg as

Medium

Ai Review Evidence

The exported URL setter and provider accept an API destination without a destination allowlist.

dist/complaint-app.jsView on unpkg · L10463

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

Source & flagged code

6 flagged

dist/complaint-app.jsView file

Lines 3734-3774javascript

3734 },

3735 write: function(e) {

3736 return encodeURIComponent(e).replace(

3737 /%(2[346BF]|3[AC-F]|40|5[BDE]|60|7[BCD])/g,

3738 decodeURIComponent

3739 );

3740 }

3741};

3742function qr(e, t) {

3743 function n(a, s, i) {

3744 if (!(typeof document > "u")) {

3745 i = yn({}, t, i), typeof i.expires == "number" && (i.expires = new Date(Date.now() + i.expires * 864e5)), i.expires && (i.expires = i.expires.toUTCString()), a =

3746 var o = "";

3747 for (var c in i)

3748 i[c] && (o += "; " + c, i[c] !== !0 && (o += "=" + i[c].split(";")[0]));

3749 return document.cookie = a + "=" + e.write(s, a) + o;

3750 }

3751 }

3752 function r(a) {

3753 if (!(typeof document > "u" || arguments.length && !a)) {

3754 for (var s = document.cookie ? document.cookie.split("; ") : [], i = {}, o = 0; o < s.length; o++) {

3755 var c = s[o].split("="), d = c.slice(1).join("=");

3756 try {

3757 var u = decodeURIComponent(c[0]);

Medium

Ai Review Evidence

The API client falls back to the browser token cookie when no caller token is supplied.

dist/complaint-app.jsView on unpkg · L3754

3758 if (u in i || (i[u] = e.read(d, u)), a === u)

3759 break;

3760 } catch {

3761 }

3762 }

3763 return a ? i[a] : i;

3764 }

3765 }

3766 return Object.create(

3767 {

3768 set: n,

3769 get: r,

3770 remove: function(a, s) {

3771 n(

3772 a,

3773 "",

3774 yn({}, s, {

Lines 3784-3868javascript

3784 }

3785 },

3786 {

3787 attributes: { value: Object.freeze(t) },

3788 converter: { value: Object.freeze(e) }

3789 }

3790 );

3791}

3792

Lines 10443-10477javascript

10443 oe as api,

10444 Vu as appDetailsReducer,

10445 K0 as clearAppDetails,

10446 q0 as clearComplaintError,

10447 z0 as clearId

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && ka("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && Ae(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", _d = la && window.location.href || "http://localhost", Nd = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg