registry / @konnectio/core / 4.8.2
@konnectio/core@4.8.2
Konnectio Core Frontend Integration.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe inspected credential and network behavior supports the package’s booking UI, using an explicitly supplied access token and same-origin request transport. The scanner’s bidi-control alert was not confirmed in the flagged bundle.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The browser integration runs when an application uses the exported UI components.
Impact
No malicious impact was identified.
Mechanism
The components send booking and gift-card requests through application routes; the inspected transport defaults to same-origin credentials.
AI rationale
The inspected credential and network behavior supports the package’s booking UI, using an explicitly supplied access token and same-origin request transport. The scanner’s bidi-control alert was not confirmed in the flagged bundle.
Network endpoints1
/gift-card/create
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports browser integration modules for hotel, availability, event, and gift-card features.
- The gift-card component accepts an access token as an explicit property.
- The gift-card component uses the relative /gift-card/create route for its application request.
- The request transport uses the supplied URL and defaults to same-origin credentials.
Evidence against
- The flagged Wix bundle contained none of the searched Trojan Source bidi control characters.
- The inspected network and credential behavior fits a browser booking integration; no unrelated collector or fixed foreign host was identified.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedProtestwareUrlStrings
Source & flagged code
7 flaggeddist/dist-DJ5mNPQY.jsView file
6917else try {
L6918: result = eval(`(${expr})`);
L6919: } catch {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dist-DJ5mNPQY.jsView on unpkg · L6917dist/polyfill.jsView file
2524try {
L2525: return Function("return require(\"" + e + "\")")();
L2526: } catch {}
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/polyfill.jsView on unpkg · L2524dist-wix/gift-card.jsView file
12contains invisible/control Unicode U+200D (zero width joiner)
`,bx=`️`,xx=`<U+200D>`,Sx=``,Cx=null,wx=null;function Tx(e=[]){let t={};cb.groups=t;let n=new cb;Cx??=kx(qy),wx??=kx(Jy),G(n,`'`,Bb),G(n,`{`,Cb),G(n,`}`,wb),G(n,`[`,Tb),G(n,`]`,Eb),G(n,`(`,Db),G(n,`)`,Ob),G(n,`<`,kb),G(n,`>`,Ab),G(n,`（`,jb
Findings
2 Critical2 High6 Medium6 Low
CriticalTrojan Source Unicodedist-wix/gift-card.js
CriticalTrigger Reachable Dangerous Capabilitydist-wix/gift-card.js
HighShips High Entropy Blobdist/AvailabilitySkeleton-BoJGAUPX.js.br
HighSemantic Analysis Limiteddist-wix/hotel.js
MediumDynamic Requiredist/polyfill.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumShips Compressed Blobdist/rolldown-runtime-B0aSnxlc.js.br
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-DJ5mNPQY.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @konnectio/core@4.8.2.
See all versions of @konnectio/core for other recorded verdicts.
- Review the evidence and your use of @konnectio/core@4.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.