registry / @konnectio/core / 4.8.6
@konnectio/core@4.8.6
Konnectio Core Frontend Integration.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe inspected credential flow sends the Konnectio bearer token to the configured Konnectio API, while checkout scripts come from the named payment providers. The reported Unicode concern was not confirmed as a bidi control-flow attack in the flagged bundle.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Widget requests when its UI invokes Konnectio API operations; payment scripts load when the checkout component is set up.
Impact
No unrelated credential transfer or other attack behavior identified.
Mechanism
The Wix gift-card client sends its Konnectio bearer token to the configured Konnectio API base. The checkout component loads the DIBS and Reepay scripts.
AI rationale
The inspected credential flow sends the Konnectio bearer token to the configured Konnectio API, while checkout scripts come from the named payment providers. The reported Unicode concern was not confirmed as a bidi control-flow attack in the flagged bundle.
Network endpoints3
production.hotel-service.konnectio.com/apicheckout.dibspayment.eu/v1/checkout.jscheckout.reepay.com/checkout.js
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes availability, hotel, event, gift-card, and Wix frontend modules; its scripts are build and development tasks.
- The Wix gift-card client reads the configured Konnectio bearer token and attaches it to requests using the Konnectio API base URL.
- The Wix checkout component loads scripts from DIBS and Reepay payment hosts.
Evidence against
- The inspected credential flow targets the package’s Konnectio service, and the checkout hosts match the payment integration’s purpose.
- The flagged Wix gift-card bundle’s inspected characters did not include bidi direction controls; observed invisible characters were in ordinary bundled text.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/dist-_pDPOtXt.jsView file
6918else try {
L6919: result = eval(`(${expr})`);
L6920: } catch {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dist-_pDPOtXt.jsView on unpkg · L6918dist-wix/gift-card.jsView file
12contains invisible/control Unicode U+200D (zero width joiner)
`,Cx=`️`,wx=`<U+200D>`,Tx=``,Ex=null,Dx=null;function Ox(e=[]){let t={};db.groups=t;let n=new db;Ex??=Mx(Xy),Dx??=Mx(Zy),G(n,`'`,Ub),G(n,`{`,Eb),G(n,`}`,Db),G(n,`[`,Ob),G(n,`]`,kb),G(n,`(`,Ab),G(n,`)`,jb),G(n,`<`,Mb),G(n,`>`,Nb),G(n,`（`,Pb
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist-wix/gift-card.jsView on unpkg · L12•Trigger-reachable chain: manifest.exports -> dist-wix/gift-card.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist-wix/gift-card.js
CriticalTrigger Reachable Dangerous Capabilitydist-wix/gift-card.js
HighShips High Entropy Blobdist/CheckoutWindow-CkCBgrae.js.br
HighSemantic Analysis Limiteddist-wix/hotel.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/rolldown-runtime-B0aSnxlc.js.br
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-_pDPOtXt.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @konnectio/core@4.8.6.
See all versions of @konnectio/core for other recorded verdicts.
- Review the evidence and your use of @konnectio/core@4.8.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.