registry / @konnectio/core / 4.8.8
@konnectio/core@4.8.8
Konnectio Core Frontend Integration.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package exports frontend booking and gift-card integrations, and the inspected token-bearing requests go to Konnectio’s service. The flagged fetch behavior is consistent with API operations, and no malicious behavior was established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The exported browser integration makes requests when its application features are used.
Impact
Expected booking and gift-card service requests; no unrelated credential transfer or unsolicited account action was found.
Mechanism
Requests use the Konnectio hotel-service API, with the app bearer token set as the Authorization header; the generic fetch adapter defaults to same-origin credentials.
AI rationale
The package exports frontend booking and gift-card integrations, and the inspected token-bearing requests go to Konnectio’s service. The flagged fetch behavior is consistent with API operations, and no malicious behavior was established.
Network endpoints2
production.hotel-service.konnectio.comwindow.KONNECTIO_API_URL_OVERRIDE
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exports browser integration modules for availability, hotels, events and gift cards.
- The Wix gift-card module reads its app bearer token and sends it to Konnectio’s hotel-service API.
- The generic fetch adapter uses same-origin credentials by default.
Evidence against
- The inspected network and credential flows are consistent with the package’s booking integration purpose.
- No attack behavior was identified in the inspected source.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggeddist/dist-BxuBCVOh.jsView file
6918else try {
L6919: result = eval(`(${expr})`);
L6920: } catch {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dist-BxuBCVOh.jsView on unpkg · L6918dist-wix/gift-card.jsView file
12contains invisible/control Unicode U+200D (zero width joiner)
`,Cx=`️`,wx=`<U+200D>`,Tx=``,Ex=null,Dx=null;function Ox(e=[]){let t={};db.groups=t;let n=new db;Ex??=Mx(Xy),Dx??=Mx(Zy),G(n,`'`,Ub),G(n,`{`,Eb),G(n,`}`,Db),G(n,`[`,Ob),G(n,`]`,kb),G(n,`(`,Ab),G(n,`)`,jb),G(n,`<`,Mb),G(n,`>`,Nb),G(n,`（`,Pb
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist-wix/gift-card.jsView on unpkg · L12•Trigger-reachable chain: manifest.exports -> dist-wix/gift-card.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist-wix/gift-card.js
CriticalTrigger Reachable Dangerous Capabilitydist-wix/gift-card.js
HighShips High Entropy Blobdist/CheckoutWindow-BYdFHOPK.js.gz
HighSemantic Analysis Limiteddist-wix/hotel.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/rolldown-runtime-B0aSnxlc.js.br
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-BxuBCVOh.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @konnectio/core@4.8.8.
See all versions of @konnectio/core for other recorded verdicts.
- Review the evidence and your use of @konnectio/core@4.8.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.