@cleartrip/ct-platform-login-popup@1.2.0
Login Popup Component for Desktop
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package performs ordinary Cleartrip login and OTP requests, but it also sends page context automatically when an OTP screen mounts. Because this runtime telemetry is not disclosed in the package metadata and no opt-out was identified, classify it as suspicious telemetry rather than malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
Automatically when the login OTP screen mounts; other UI events also invoke the reporting wrapper.
Impact
The host's analytics system can receive page-view and interaction context, including the current page host and UTM source. No credential transfer to that manager was identified in the inspected wrapper.
Mechanism
The package calls ravenSDKTrigger, which forwards page and event data to window.ravenWebManager.triggerRaven.
AI rationale
The package performs ordinary Cleartrip login and OTP requests, but it also sends page context automatically when an OTP screen mounts. Because this runtime telemetry is not disclosed in the package metadata and no opt-out was identified, classify it as suspicious telemetry rather than malicious behavior.
Evidence
dist/ct-platform-login-popup.cjs.js.lpm-dependency-evidence-0b2ed2c8-c9c4-48da-bb8d-e9d288dc7dcc/2/npm-linux/dist/ct-platform-utils.cjs.js
Network endpoints2
window.ravenWebManager.triggerRaven (destination configured by the host application; URL is not present in the package)biztrip.cleartrip.com (API base; paths include /v1/user/login, /v1/user/login/verify, /v1/user/signup, /v1/user/signup/verify, /v1/otp/send)
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The OTP screen sends a page-load event automatically when it mounts.
- The Raven utility adds the current page name, UTM source, page host, experiment, platform, and login status before calling the host application's Raven manager.
- The manifest describes a Cleartrip login popup and declares no install lifecycle scripts.
- Authentication requests use the platform API domain for login and OTP operations; the inspected utility maps to Cleartrip domains or localhost.
Evidence against
- The Raven destination is supplied by the host application, and the inspected event wrapper does not attach credentials to its events.
- The API requests correspond to the package's login, signup, verification, and OTP resend functions.
Behavioral surface
Network
MinifiedTrivialUrlStrings
Source & flagged code
7 flaggeddist/ct-platform-login-popup.cjs.jsView file
1N=u.useState(""),S=N[0],L=N[1];u.useEffect(function(){re(D.PAGELOAD,{page_name:M.LOGIN_OTP})},[]);var O=function(e){C(e),L("")};return l.jsx(c.Container,r.__assign({display:"flex",flexDirection:"column",height:"100%",width:"100%",justifyContent:"space-between"
Medium
Ai Review Evidence
The OTP screen sends a page-load event automatically when it mounts.
dist/ct-platform-login-popup.cjs.jsView on unpkg · L11aiter(void 0,void 0,void 0,function(){var i,t,a,o;return r.__generator(this,function(s){switch(s.label){case 0:return i=p.urlJoin(p.getApiDomain(),e),t={accept:"application/json","Content-Type":"application/json"},p.isServer()||(t.channel=p.getDevicePlatform(),t["app-agent"]=p.getAppAgent()),[4,fetch(i,{method:"POST",headers:t,body:JSON.stringify(n)})];case 1:a=s.sent(),o=null,s.label=2;case 2:return s.trys.push([2,4,,5]),[4,a.json()];case 3:retu
Medium
Ai Review Evidence
Authentication requests use the platform API domain for login and OTP operations; the inspected utility maps to Cleartrip domains or localhost.
dist/ct-platform-login-popup.cjs.jsView on unpkg · L1Findings
8 Medium2 Low
MediumNetwork
MediumAi Review Evidencedist/ct-platform-login-popup.cjs.js
MediumAi Review Evidence.lpm-dependency-evidence-0b2ed2c8-c9c4-48da-bb8d-e9d288dc7dcc/2/npm-linux/dist/ct-platform-utils.cjs.js
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/ct-platform-login-popup.cjs.js
MediumAi Review Evidencedist/ct-platform-login-popup.cjs.js
MediumAi Review Evidence.lpm-dependency-evidence-0b2ed2c8-c9c4-48da-bb8d-e9d288dc7dcc/2/npm-linux/dist/ct-platform-utils.cjs.js
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to @cleartrip/ct-platform-login-popup@1.2.0.
See all versions of @cleartrip/ct-platform-login-popup for other recorded verdicts.
- Review the evidence and your use of @cleartrip/ct-platform-login-popup@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.