registry / @konnectio/core / 4.9.0
@konnectio/core@4.9.0
Konnectio Core Frontend Integration.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest contains no install lifecycle hook, and the inspected credential flow sends a bearer token to Konnectio’s own hotel-service API. The flagged bundle and Unicode indicators did not establish harmful behavior in the source excerpts inspected.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Frontend modules run when imported or used by an integrating application; the inspected payment script loads when the checkout integration needs it.
Impact
The inspected behavior supports the package’s booking and payment integration purpose; no malicious impact was identified.
Mechanism
The inspected request setup uses a bearer token from package state with Konnectio’s API; the payment integration loads Reepay’s checkout script.
AI rationale
The manifest contains no install lifecycle hook, and the inspected credential flow sends a bearer token to Konnectio’s own hotel-service API. The flagged bundle and Unicode indicators did not establish harmful behavior in the source excerpts inspected.
Network endpoints2
production.hotel-service.konnectio.comcheckout.reepay.com
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall, or postinstall lifecycle hook; its scripts are build and development commands.
- The package exports frontend availability, hotel, event, and gift-card modules.
- The Wix gift-card module reads a bearer token from package state and configures requests for Konnectio’s hotel-service API.
- The request helper sends request fields through its configured HTTP client.
- The gift-card module loads Reepay’s checkout script, consistent with its payment integration purpose.
Evidence against
- No inspected code showed credentials being sent to an unrelated host or account actions being performed without a user request.
- The scanner’s Trojan Source and compressed-blob findings did not establish harmful runtime behavior in the inspected excerpts.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/dist-CuXxMFmQ.jsView file
6918else try {
L6919: result = eval(`(${expr})`);
L6920: } catch {
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/dist-CuXxMFmQ.jsView on unpkg · L6918dist-wix/gift-card.jsView file
12contains invisible/control Unicode U+200D (zero width joiner)
`,Cx=`️`,wx=`<U+200D>`,Tx=``,Ex=null,Dx=null;function Ox(e=[]){let t={};db.groups=t;let n=new db;Ex??=Mx(Xy),Dx??=Mx(Zy),G(n,`'`,Ub),G(n,`{`,Eb),G(n,`}`,Db),G(n,`[`,Ob),G(n,`]`,kb),G(n,`(`,Ab),G(n,`)`,jb),G(n,`<`,Mb),G(n,`>`,Nb),G(n,`（`,Pb
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist-wix/gift-card.jsView on unpkg · L12•Trigger-reachable chain: manifest.exports -> dist-wix/gift-card.js
Reachable file contains a blocking source-risk pattern.
Findings
2 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist-wix/gift-card.js
CriticalTrigger Reachable Dangerous Capabilitydist-wix/gift-card.js
HighShips High Entropy Blobdist/i18n-_behsDNX.js.gz
HighSemantic Analysis Limiteddist-wix/hotel.js
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobdist/rolldown-runtime-B0aSnxlc.js.br
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dist-CuXxMFmQ.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @konnectio/core@4.9.0.
See all versions of @konnectio/core for other recorded verdicts.
- Review the evidence and your use of @konnectio/core@4.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.