@cleartrip/ct-platform-book-zero-trip-widget@1.5.0
Book Zero Trip Widget Component
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundle sends runtime analytics containing trip IDs and page context, including an impression event that can run without a direct user action. The package does not disclose or expose a way to disable that telemetry, so this warrants a warning; the inspected source shows no credential theft or unrelated attack behavior.
Decision evidence
public snapshot- The package is a Book Zero Trip Widget with CommonJS and ESM browser entry points.
- The widget sends Raven analytics for pay-now clicks, including page, platform, vertical and trip ID fields.
- The widget also sends an impression event with page, platform, vertical and trip ID fields when a carousel slide changes or the widget becomes visible.
- The manifest declares no install, preinstall or postinstall hook; its scripts are build and test commands.
- The inspected event payloads contain booking context but no credentials, environment variables or file contents.
- Payment navigation and click analytics are tied to the Pay now button; the widget does not show unrelated account actions or direct network endpoints.
Source & flagged code
4 flaggedThe package is a Book Zero Trip Widget with CommonJS and ESM browser entry points.
package.jsonView on unpkg · L2The widget sends Raven analytics for pay-now clicks, including page, platform, vertical and trip ID fields.
dist/ct-platform-book-zero-trip-widget.cjs.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to @cleartrip/ct-platform-book-zero-trip-widget@1.5.0.
See all versions of @cleartrip/ct-platform-book-zero-trip-widget for other recorded verdicts.
- Review the evidence and your use of @cleartrip/ct-platform-book-zero-trip-widget@1.5.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.