@timum/booking@1.30.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@timum/booking@1.30.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

build/booking.umd.cjsView file

•Credential-bearing message sent to a fixed external iframe in build/booking.umd.cjs: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... `)}function wae({appConfig:t,muiTheme:e,fcConfig:n,iFrameStyle:r}){const i=_.useRef(null);i.current===null&&(i.current=DD("timum_booking_iframe"));const s=i.current,o=t.cdnUrl??"ht... `));const l=_.useMemo(()=>({...t,queryString:window.location.search,queryHash:window.location.hash,isComponent:!0}),[t]);return _.useEffect(()=>{const c=IT.get(s);if(c&&(!uE(c.appC... */var kN;function Sae(){return kN||(kN=1,(function(t){function e(K,X){var Z=K.length;K.push(X);e:for(;0<Z;){var q=Z-1>>>1,ee=K[q];if(0<i(ee,X))K[q]=X,K[Z]=ee,Z=q;e

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

build/booking.umd.cjsView on unpkg

27<span class="tmk-sr">${c}</span> L28: </div>`}function nse(t,e){t&&!t.querySelector(".tmk-spin")&&(t.innerHTML=FD(e))}function rse({rootElId:t,margin:e,bootUrl:n,initBody:r,loadMode:i="eager",loaderHtml:s=""}){const o=... L29: <div id="${o}" style="margin: ${e}"> ... L66: </div> L67: `}async function ise(t,e,n,r){let i=r==null?void 0:r.getElementById((t==null?void 0:t.rootElId)??"bookingjs");i||(i=document.getElementById((t==null?void 0:t.rootElId)??"bookingjs"... L68: L69: attempted value: ${s} L70: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... L71: const context = window.parent.document; ... L101: `),G=P.length-1,re=B.length-1;1<=G&&0<=re&&P[G]!=

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

build/booking.umd.cjsView on unpkg · L27

build/booking-A2D5Gr4l.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/booking-A2D5Gr4l.jsView on unpkg

68591const n3 = new Uwe({ projectKey: "hhinKen4c7vz6k3O3ihy", ingestPoint: "https://openreplay.timum.io/ingest", network: { capturePayload: !0 }, css: { scanInMemoryCSS: !0 } });

High

Ai Review Evidence

The chunk configures a fixed Timum OpenReplay ingestion endpoint and enables capture of network request and response payloads.

build/booking-A2D5Gr4l.jsView on unpkg · L68591

68612return Se.useEffect(() => { if (n) return; const i = e !== void 0; let o = !0; (t === "https://staging.timum.de" || t === "https://i4urpzk96y6mnxp72nygtivnoxczzk.local-dev.timum.io") && (o = !1), o = i ? e : o, o && !yI && (n3.start({ userID: crypto.randomUUID() }), yI = !0);

High

Ai Review Evidence

The tracker starts automatically in a React effect unless disabled by configuration or the page is a staging/local development API.

build/booking-A2D5Gr4l.jsView on unpkg · L68612

build/booking-B4GF8fhG.jsView file

134const a = g("bookingjs"), { mountBooking: n } = await import("./booking-A2D5Gr4l.js").then((i) => i.a_); n({ rootEl: r, appConfig: t, muiTheme: e, fcConfig: s, instanceId: a });

High

Ai Review Evidence

The published module dynamically loads the tracker-containing chunk when booking is mounted.

build/booking-B4GF8fhG.jsView on unpkg · L134

Source & flagged code

6 flagged

build/booking.umd.cjsView file

•Credential-bearing message sent to a fixed external iframe in build/booking.umd.cjs: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... `)}function wae({appConfig:t,muiTheme:e,fcConfig:n,iFrameStyle:r}){const i=_.useRef(null);i.current===null&&(i.current=DD("timum_booking_iframe"));const s=i.current,o=t.cdnUrl??"ht... `));const l=_.useMemo(()=>({...t,queryString:window.location.search,queryHash:window.location.hash,isComponent:!0}),[t]);return _.useEffect(()=>{const c=IT.get(s);if(c&&(!uE(c.appC... */var kN;function Sae(){return kN||(kN=1,(function(t){function e(K,X){var Z=K.length;K.push(X);e:for(;0<Z;){var q=Z-1>>>1,ee=K[q];if(0<i(ee,X))K[q]=X,K[Z]=ee,Z=q;e

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

build/booking.umd.cjsView on unpkg

27<span class="tmk-sr">${c}</span> L28: </div>`}function nse(t,e){t&&!t.querySelector(".tmk-spin")&&(t.innerHTML=FD(e))}function rse({rootElId:t,margin:e,bootUrl:n,initBody:r,loadMode:i="eager",loaderHtml:s=""}){const o=... L29: <div id="${o}" style="margin: ${e}"> ... L66: </div> L67: `}async function ise(t,e,n,r){let i=r==null?void 0:r.getElementById((t==null?void 0:t.rootElId)??"bookingjs");i||(i=document.getElementById((t==null?void 0:t.rootElId)??"bookingjs"... L68: L69: attempted value: ${s} L70: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... L71: const context = window.parent.document; ... L101: `),G=P.length-1,re=B.length-1;1<=G&&0<=re&&P[G]!=

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

build/booking.umd.cjsView on unpkg · L27

build/booking-A2D5Gr4l.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/booking-A2D5Gr4l.jsView on unpkg

68591const n3 = new Uwe({ projectKey: "hhinKen4c7vz6k3O3ihy", ingestPoint: "https://openreplay.timum.io/ingest", network: { capturePayload: !0 }, css: { scanInMemoryCSS: !0 } });

High

Ai Review Evidence

The chunk configures a fixed Timum OpenReplay ingestion endpoint and enables capture of network request and response payloads.

build/booking-A2D5Gr4l.jsView on unpkg · L68591

68612return Se.useEffect(() => { if (n) return; const i = e !== void 0; let o = !0; (t === "https://staging.timum.de" || t === "https://i4urpzk96y6mnxp72nygtivnoxczzk.local-dev.timum.io") && (o = !1), o = i ? e : o, o && !yI && (n3.start({ userID: crypto.randomUUID() }), yI = !0);

High

Ai Review Evidence

The tracker starts automatically in a React effect unless disabled by configuration or the page is a staging/local development API.

build/booking-A2D5Gr4l.jsView on unpkg · L68612

build/booking-B4GF8fhG.jsView file

Lines 114-147javascript

114 var done = false;

115 var go = function () { if (done) return; done = true; idle(); };