@attabot/complaint-app@1.0.31: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@attabot/complaint-app@1.0.31: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/complaint-app.jsView file

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && xa("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && Re(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", Ad = ca && window.location.href || "http://localhost", Ld = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

3804const vu = (e) => { Lt = e || "", de.defaults.baseURL = Lt; }, Io = (e) => { xo = e || null; }, Su = () => xo || Ut.get("token") || null, de = ue.create({ baseURL: Lt, headers: { Accept: "

Medium

Ai Review Evidence

The API client accepts an unrestricted base URL and falls back to the browser token cookie when no caller token is supplied.

dist/complaint-app.jsView on unpkg · L3804

3815de.interceptors.request.use((e) => { const t = Su(); return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e; }); let br = !1, wr = null

Medium

Ai Review Evidence

The request interceptor attaches that token as a bearer credential to API requests.

dist/complaint-app.jsView on unpkg · L3815

3825const r = Ut.get("refreshToken"); if (r) try { br || (br = !0, wr = ue.post( `${Lt}/api/v1/auth/refresh`, {}, { headers: { Authorization: `Bearer ${r}` } } )); const a = await wr, { t

Medium

Ai Review Evidence

After an authentication error, the client sends the browser refreshToken cookie to the configured base URL.

dist/complaint-app.jsView on unpkg · L3825

3848const Cu = nn(null), Nu = ({ children: e, apiUrl: t, authToken: n }) => (t && vu(t), Io(n || null), /* @__PURE__ */ l(Cu.Provider, { value: { apiUrl: t, authToken: n }, children: e })), Ge = {

Medium

Ai Review Evidence

ComplaintApp passes caller configuration into the authentication provider; mounting the complaint page dispatches an authenticated API request.

dist/complaint-app.jsView on unpkg · L3848

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

Source & flagged code

6 flagged

dist/complaint-app.jsView file

Lines 3784-3868javascript

3784 }

3785 },

3786 {

3787 attributes: { value: Object.freeze(t) },

3788 converter: { value: Object.freeze(e) }

3789 }

3790 );

3791}

3792var Ut = Wr(bu, { path: "/" });

3793const wu = { BASE_URL: "/", DEV: !1, MODE: "production", PROD: !0, SSR: !1 };

3794let Lt = "https://api-grievance.airaops.com", xo = null;

3795try {

3796 if (typeof import.meta < "u" && wu?.VITE_API_URL)

3797 Lt = void 0;

3798 else {

3799 const e = typeof process < "u" ? process : null;

3800 e?.env?.VITE_API_URL && (Lt = e.env.VITE_API_URL);

3801 }

3802} catch {

3803}

3804const vu = (e) => {

3805 Lt = e || "", de.defaults.baseURL = Lt;

3806}, Io = (e) => {

3807 xo = e || null;

3808}, Su = () => xo || Ut.get("token") || null, de = ue.create({

3809 baseURL: Lt,

3810 headers: {

3811 Accept: "application/json",

Medium

Ai Review Evidence

The API client accepts an unrestricted base URL and falls back to the browser token cookie when no caller token is supplied.

dist/complaint-app.jsView on unpkg · L3804

3812 "Content-Type": "application/json"

3813 }

3814});

3815de.interceptors.request.use((e) => {

3816 const t = Su();

3817 return e.headers = e.headers || {}, t ? e.headers.Authorization = `Bearer ${t}` : delete e.headers.Authorization, e;

3818});

3819let br = !1, wr = null;

Medium

Ai Review Evidence

The request interceptor attaches that token as a bearer credential to API requests.

dist/complaint-app.jsView on unpkg · L3815

3820de.interceptors.response.use(

3821 (e) => e,

3822 async (e) => {

3823 const t = e.config, n = e.response;

3824 if (n && (n.status === 401 || n.status === 402)) {

3825 const r = Ut.get("refreshToken");

3826 if (r)

3827 try {

3828 br || (br = !0, wr = ue.post(

3829 `${Lt}/api/v1/auth/refresh`,

3830 {},

3831 {

3832 headers: {

3833 Authorization: `Bearer ${r}`

3834 }

3835 }

3836 ));

Medium

Ai Review Evidence

After an authentication error, the client sends the browser refreshToken cookie to the configured base URL.

dist/complaint-app.jsView on unpkg · L3825

3837 const a = await wr, { token: s, refreshToken: o } = a.data;

3838 return Io(s), o && Ut.set("refreshToken", o), t.headers.Authorization = `Bearer ${s}`, de(t);

3839 } catch {

3840 Ut.remove("token"), Ut.remove("refreshToken");

3841 } finally {

3842 br = !1, wr = null;

3843 }

3844 }

3845 return Promise.reject(e);

3846 }

3847);

3848const Cu = nn(null), Nu = ({ children: e, apiUrl: t, authToken: n }) => (t && vu(t), Io(n ||

3849 mode: "light",

Medium

Ai Review Evidence

ComplaintApp passes caller configuration into the authentication provider; mounting the complaint page dispatches an authenticated API request.

dist/complaint-app.jsView on unpkg · L3848

3850 colors: {

3851 primary: "#2D64B8",

3852 primaryHover: "#2557A3",

3853 text: "#111827",

3854 textSecondary: "#6B7280",

3855 textMuted: "#9CA3AF",

3856 border: "#E5E7EB",

3857 borderLight: "#F3F4F6",

3858 background: "#FFFFFF",

3859 surface: "#FFFFFF",

3860 white: "#FFFFFF",

3861 onPrimary: "#FFFFFF",

3862 activeBg: "#ECFDF5",

3863 activeBorder: "#A7F3D0",

3864 activeText: "#059669",

3865 inactiveBg: "#F3F4F6",

3866 inactiveBorder: "#D1D5DB",

3867 inactiveText: "#6B7280",

3868 link: "#2D64B8",

•Browser cookie sent to a fixed external endpoint in dist/complaint-app.js: return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; e?.v7_startTransition === void 0 && xa("v7_startTransition", "React Router will begin wrapping state updates in `React.startTransition` in v7", "https://reactrouter.com/v6/upgradin... return e + " must be used within a data router. See https://reactrouter.com/v6/routers/picking-a-router."; process.env.NODE_ENV !== "production" && Re(typeof URLSearchParams < "u", "You cannot use the `useSearchParams` hook in a browser that does not support the URLSearchParams API. If ... self instanceof WorkerGlobalScope && typeof self.importScripts == "function", Ad = ca && window.location.href || "http://localhost", Ld = /*

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/complaint-app.jsView on unpkg

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg