@cleartrip/ct-platform-hotel-cross-sell-lpg-content@4.7.0
Hotel cross sell LPG content Component
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the entry points implement a hotel content widget. Its analytics and configured-URL navigation are tied to widget interaction; no credential collection, unrelated network endpoint, or other attack behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Importing exposes the widget; analytics and navigation occur through component effects and a user click.
Impact
Expected widget rendering, analytics reporting, and user-requested navigation; no malicious impact identified.
Mechanism
The widget reports hotel-view and click metadata through the Raven helper and uses its configured know-more URL after a click.
AI rationale
The manifest has no install lifecycle hooks, and the entry points implement a hotel content widget. Its analytics and configured-URL navigation are tied to widget interaction; no credential collection, unrelated network endpoint, or other attack behavior was found.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest has no lifecycle hooks; its scripts are build and watch commands.
- The CommonJS and ESM entry points export a React hotel content widget.
- Analytics is emitted in a component effect after the widget state changes, and the “View more details” click handler navigates to the widget’s configured URL.
Evidence against
- The widget sends hotel-view and click metadata to its Raven analytics helper.
- The widget can navigate the browser to a configured URL when the user clicks “View more details”.
Behavioral surface
MinifiedTrivial
Source & flagged code
4 flaggedpackage.jsonView file
26"author": "Cleartrip",
"license": "ISC",
"scripts": {
"watch-package": "rollup -c -w",
"build-package": "rollup -c",
"build-package:clean": "rm -rf dist && rollup -c"
}
}
Low
Suspicious Lifecycle Evidence
The package manifest has no lifecycle hooks; its scripts are build and watch commands.
package.jsonView on unpkg · L26dist/ct-platform-hotel-cross-sell-lpg-content.cjs.jsView file
1t:400;line-height:20px;padding-inline-start:16px}");exports.HotelLPGContentWidget=function(n){var s,j,w,W,k=n.content,N=n.cssStyle,S=void 0===N?{}:N,B=n.isLoading,b=n.tripId,E=n.pageName,F=n.location,I=n.vertic
Low
Ai Review Evidence
The CommonJS and ESM entry points export a React hotel content widget.
dist/ct-platform-hotel-cross-sell-lpg-content.cjs.jsView on unpkg · L1Findings
5 Low
LowScripts Present
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/ct-platform-hotel-cross-sell-lpg-content.cjs.js
LowAi Review Evidencedist/ct-platform-hotel-cross-sell-lpg-content.cjs.js
LowAi Review Evidencedist/ct-platform-hotel-cross-sell-lpg-content.cjs.js
Affected versions and remediation
This report applies to @cleartrip/ct-platform-hotel-cross-sell-lpg-content@4.7.0.
See all versions of @cleartrip/ct-platform-hotel-cross-sell-lpg-content for other recorded verdicts.
- Review the evidence and your use of @cleartrip/ct-platform-hotel-cross-sell-lpg-content@4.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.