Loading npm security reports…

@timum/booking@1.29.0: Suspicious npm security report (Warn) | LPM Firewall

registry / @timum/booking / 1.29.0

@timum/booking@1.29.0

## Introduction

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

On rebook pages, the browser widget starts a session-replay tracker configured to capture network payloads. It can transmit booking-flow request/response content to a Timum-controlled OpenReplay endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Rendering the widget on a URL containing "rebook".

Impact

Potential disclosure of customer and booking data to the configured telemetry service.

Mechanism

Session replay and network-payload telemetry.

AI rationale

The package contains an explicit but high-risk session-replay telemetry path, not install-time malware or a covert execution chain. Warn for payload capture in customer booking flows.

Evidence

package.jsonbuild/booking-DArewESd.jsbuild/booking-DArewESd.js.map

Network endpoints1

openreplay.timum.io/ingest

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

build/booking-DArewESd.js configures OpenReplay with capturePayload:true.

Source & flagged code

3 flagged · loading source

build/booking.umd.cjsView file

•Credential-bearing message sent to a fixed external iframe in build/booking.umd.cjs: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... `)}function yae({appConfig:t,muiTheme:e,fcConfig:n,iFrameStyle:r}){const i=_.useRef(null);i.current===null&&(i.current=DI("timum_booking_iframe"));const s=i.current,o=t.cdnUrl??"ht... `));const l=_.useMemo(()=>({...t,queryString:window.location.search,queryHash:window.location.hash,isComponent:!0}),[t]);return _.useEffect(()=>{const c=_T.get(s);if(c&&(!aE(c.appC... */var CN;function vae(){return CN||(CN=1,(function(t){function e(K,X){var Z=K.length;K.push(X);e:for(;0<Z;){var q=Z-1>>>1,ee=K[q];if(0<i(ee,X))K[q]=X,K[Z]=ee,Z=q;e

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

build/booking.umd.cjsView on unpkg

27<span class="tmk-sr">${c}</span> L28: </div>`}function Xie(t,e){t&&!t.querySelector(".tmk-spin")&&(t.innerHTML=LI(e))}function Jie({rootElId:t,margin:e,bootUrl:n,initBody:r,loadMode:i="eager",loaderHtml:s=""}){const o=... L29: <div id="${o}" style="margin: ${e}"> ... L66: </div> L67: `}async function ese(t,e,n,r){let i=r==null?void 0:r.getElementById((t==null?void 0:t.rootElId)??"bookingjs");i||(i=document.getElementById((t==null?void 0:t.rootElId)??"bookingjs"... L68: L69: attempted value: ${s} L70: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... L71: const context = window.parent.document; ... L101: `),G=P.length-1,re=B.length-1;1<=G&&0<=re&&P[G]!=

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

build/booking.umd.cjsView on unpkg · L27

16* LICENSE file in the root directory of this source tree. L17: */var BM;function Pre(){if(BM)return A1;BM=1;var t=lm(),e=Symbol.for("react.element"),n=Symbol.for("react.fragment"),r=Object.prototype.hasOwnProperty,i=t.__SECRET_INTERNALS_DO_NOT... L18: .tmk-root{box-sizing:border-box;min-height:${s};display:flex;align-items:center;justify-content:center;padding:8px}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/booking.umd.cjsView on unpkg · L16

Source & flagged code

3 flagged

build/booking.umd.cjsView file

•Credential-bearing message sent to a fixed external iframe in build/booking.umd.cjs: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... `)}function yae({appConfig:t,muiTheme:e,fcConfig:n,iFrameStyle:r}){const i=_.useRef(null);i.current===null&&(i.current=DI("timum_booking_iframe"));const s=i.current,o=t.cdnUrl??"ht... `));const l=_.useMemo(()=>({...t,queryString:window.location.search,queryHash:window.location.hash,isComponent:!0}),[t]);return _.useEffect(()=>{const c=_T.get(s);if(c&&(!aE(c.appC... */var CN;function vae(){return CN||(CN=1,(function(t){function e(K,X){var Z=K.length;K.push(X);e:for(;0<Z;){var q=Z-1>>>1,ee=K[q];if(0<i(ee,X))K[q]=X,K[Z]=ee,Z=q;e

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

build/booking.umd.cjsView on unpkg

27<span class="tmk-sr">${c}</span> L28: </div>`}function Xie(t,e){t&&!t.querySelector(".tmk-spin")&&(t.innerHTML=LI(e))}function Jie({rootElId:t,margin:e,bootUrl:n,initBody:r,loadMode:i="eager",loaderHtml:s=""}){const o=... L29: <div id="${o}" style="margin: ${e}"> ... L66: </div> L67: `}async function ese(t,e,n,r){let i=r==null?void 0:r.getElementById((t==null?void 0:t.rootElId)??"bookingjs");i||(i=document.getElementById((t==null?void 0:t.rootElId)??"bookingjs"... L68: L69: attempted value: ${s} L70: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... L71: const context = window.parent.document; ... L101: `),G=P.length-1,re=B.length-1;1<=G&&0<=re&&P[G]!=

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

build/booking.umd.cjsView on unpkg · L27

16* LICENSE file in the root directory of this source tree. L17: */var BM;function Pre(){if(BM)return A1;BM=1;var t=lm(),e=Symbol.for("react.element"),n=Symbol.for("react.fragment"),r=Object.prototype.hasOwnProperty,i=t.__SECRET_INTERNALS_DO_NOT... L18: .tmk-root{box-sizing:border-box;min-height:${s};display:flex;align-items:center;justify-content:center;padding:8px}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/booking.umd.cjsView on unpkg · L16