@cleartrip/ct-platform-hotel-recommendations@2.8.0
Hotel Recommendations Component
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe component’s click and impression tracking sends trip and hotel context through analytics calls, with no disclosure or opt-out visible in the package source. This is suspicious runtime telemetry, though the events are related to the widget’s hotel recommendation function.
Static reason
No blocking static signals were detected.
Trigger
A user clicks a recommendation card, or a card enters view.
Impact
Hotel and trip context may be disclosed to the analytics service without a documented opt-out.
Mechanism
The component sends event data through Raven analytics calls; the source does not show the analytics endpoint or a way to disable these events.
AI rationale
The component’s click and impression tracking sends trip and hotel context through analytics calls, with no disclosure or opt-out visible in the package source. This is suspicious runtime telemetry, though the events are related to the widget’s hotel recommendation function.
Evidence
dist/ct-platform-hotel-recommendations.cjs.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The main entry is a hotel recommendations component.
- Click analytics include trip ID, hotel ID and name, destination, travel dates, coupon status and hotel ratings.
- A card impression event is emitted when the card enters view.
- The widget automatically writes hotel search criteria and a generated lineage ID to cookies, then requests hotel recommendations.
Evidence against
- The analytics events describe hotel card clicks and impressions, which fit the widget’s purpose.
- The visible image URLs point to Cleartrip/Flipkart-hosted hotel imagery; no unrelated collector or credential flow was identified.
- No install, preinstall or postinstall script is declared.
Behavioral surface
HighEntropyStringsMinifiedTrivialUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
6"main": "dist/ct-platform-hotel-recommendations.cjs.js",
"module": "dist/ct-platform-hotel-recommendations.esm.js",
"sideEffects": false,
"files": [
"dist"
],
"dependencies": {
"@cleartrip/ct-design-button": "3.7.0",
"@cleartrip/ct-design-theme": "3.7.0",
"@cleartrip/ct-design-typography": "3.7.0",
"classnames": "^2.5.1",
Medium
Ai Review Evidence
The main entry is a hotel recommendations component.
package.jsonView on unpkg · L6dist/ct-platform-hotel-recommendations.cjs.jsView file
1a_trip_id:c,h_hotel_rank:l,h_hotel_id:_,page_name:h,ab_variant:m,child_product:"hotel",a_destination:x,ct_coupon_applied:s,transaction_id_ca:c,onward_date:R,search_destination:x,a_departure_date:R,object_name:null==f?void 0:f.hotelName,h_hotel_name:null==f?void 0:f.hotelName,h_total_discount_percent:null==v?void 0:v.discountPercentage,h_star_category:null==f?void 0:f.starRating,h_user_rating:null==f?void 0:f.userRating,loyalty_type:C,action_type:"click",action_name:"hotel_cross_sell_click",personalised_callout:"hotel_card_click",h_dx:w?a.getNoOfDaysFromToday(w):""};A||(i=e.
Medium
Ai Review Evidence
Click analytics include trip ID, hotel ID and name, destination, travel dates, coupon status and hotel ratings.
dist/ct-platform-hotel-recommendations.cjs.jsView on unpkg · L11_sell_click",personalised_callout:"hotel_card_click",h_dx:w?a.getNoOfDaysFromToday(w):""};A||(i=e.__assign(e.__assign({},i),{platform:"desktop"})),a.ravenSDKTrigger("u_ui_action",i),k&&(window.location.href=k)},[k]),E=o.useCallback(function(){O.current||(O.current=!0,G(u))},[]),K=o.useCallback(function(){var i={vertical:p,a_trip_id:c,h_ho
Medium
Ai Review Evidence
A card impression event is emitted when the card enters view.
dist/ct-platform-hotel-recommendations.cjs.jsView on unpkg · L11okie({cookieName:"x-lineage-id",cookieValue:l.v4(),expiryInDay:1}),a.getHotelCrossSellRecos(m,g,u,null==T?void 0:T.couponCallOutPrefix,null==T?void 0:T.couponCallOutSuffix,null==T?void 0:T.offerCallOut,null==T?void 0:T.additionalHeaders,null==T?void 0:T.additionalParams,b).then(function(e){var i=G(e);I(i),setTimeout(function(){W(!1)},10),setTimeout(function(){F(!0)},180)})}},[D]),i.jsxs(s.ThemeProvider,{children:[i.jsx(we,e.__assign({data:S,loading:B,pageName:r,vertical:m,location:t,abVariant:d,maxCardsCount:v,dest
Medium
Ai Review Evidence
The widget automatically writes hotel search criteria and a generated lineage ID to cookies, then requests hotel recommendations.
dist/ct-platform-hotel-recommendations.cjs.jsView on unpkg · L1Findings
4 Medium3 Low
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist/ct-platform-hotel-recommendations.cjs.js
MediumAi Review Evidencedist/ct-platform-hotel-recommendations.cjs.js
MediumAi Review Evidencedist/ct-platform-hotel-recommendations.cjs.js
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @cleartrip/ct-platform-hotel-recommendations@2.8.0.
See all versions of @cleartrip/ct-platform-hotel-recommendations for other recorded verdicts.
- Review the evidence and your use of @cleartrip/ct-platform-hotel-recommendations@2.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.