registry / @konnectio/core / 4.7.15
@konnectio/core@4.7.15
Konnectio Core Frontend Integration.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged bundle implements the package’s browser booking component, and its bearer token is directed to Konnectio’s service. Although it embeds Flare error reporting, the reporter has no default API key and exits before sending without one; the scanner’s invisible-character flag is consistent with a BOM used by a download helper.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing a browser entry registers its custom element and installs error listeners; booking requests occur through the UI.
Impact
No unauthorized data collection or other attack behavior was identified in the reviewed paths.
Mechanism
The booking code sends its bearer token to Konnectio’s service endpoint (or a caller-supplied API URL). Flare reports require an API key, which defaults to null.
AI rationale
The flagged bundle implements the package’s browser booking component, and its bearer token is directed to Konnectio’s service. Although it embeds Flare error reporting, the reporter has no default API key and exits before sending without one; the scanner’s invisible-character flag is consistent with a BOM used by a download helper.
Network endpoints3
production.hotel-service.konnectio.com/apiingress.flareapp.io/v1/errorsingress.flareapp.io/v1/logs
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports booking UI modules and contains no install lifecycle hooks.
- The Wix availability bundle registers the `konnectio-availability` browser component, consistent with the package’s frontend integration purpose.
- The availability code reads its bearer token from Konnectio state and sends it to Konnectio’s production hotel service or a caller-supplied API URL.
- The embedded Flare reporter has no API key by default and checks for a key before sending reports.
- The import-time Flare listeners forward errors to that reporter; the key check prevents reports from being sent by default.
Evidence against
- A Flare error-reporting SDK and its external ingestion URL are embedded in the browser bundle, though reporting is gated on configuration.
- The bundle contains a BOM character in a UTF-8 download helper, which could explain an invisible-Unicode scanner flag.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggeddist/dist-AhXjLLR1.jsView file
6875else try {
L6876: result = eval(`(${expr})`);
L6877: } catch {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dist-AhXjLLR1.jsView on unpkg · L6875dist-wix/availability.jsView file
22contains invisible/control Unicode U+200D (zero width joiner)
`,Ow=`️`,kw=`<U+200D>`,Aw=``,jw=null,Mw=null;function Nw(e=[]){let t={};hC.groups=t;let n=new hC;jw??=Lw(eC),Mw??=Lw(tC),X(n,`'`,JC),X(n,`{`,jC),X(n,`}`,MC),X(n,`[`,NC),X(n,`]`,PC),X(n,`(`,FC),X(n,`)`,IC),X(n,`<`,LC),X(n,`>`,RC),X(n,`（`,zC
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist-wix/availability.jsView on unpkg · L22•Trigger-reachable chain: manifest.exports -> dist-wix/availability.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical1 High4 Medium6 Low
CriticalTrojan Source Unicodedist-wix/availability.js
CriticalTrigger Reachable Dangerous Capabilitydist-wix/availability.js
HighShips High Entropy Blobdist/style-DT-etRss.js.gz
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/gift-card-validation.js.gz
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-AhXjLLR1.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @konnectio/core@4.7.15.
See all versions of @konnectio/core for other recorded verdicts.
- Review the evidence and your use of @konnectio/core@4.7.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.