@timum/booking@1.31.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@timum/booking@1.31.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

build/booking.umd.cjsView file

•Credential-bearing message sent to a fixed external iframe in build/booking.umd.cjs: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... `)}function Aae({appConfig:t,muiTheme:e,fcConfig:n,iFrameStyle:r}){const i=_.useRef(null);i.current===null&&(i.current=DD("timum_booking_iframe"));const s=i.current,o=t.cdnUrl??"ht... `));const l=_.useMemo(()=>({...t,queryString:window.location.search,queryHash:window.location.hash,isComponent:!0}),[t]);return _.useEffect(()=>{const c=IT.get(s);if(c&&(!uE(c.appC... */var kN;function $ae(){return kN||(kN=1,(function(t){function e(K,X){var Z=K.length;K.push(X);e:for(;0<Z;){var q=Z-1>>>1,ee=K[q];if(0<i(ee,X))K[q]=X,K[Z]=ee,Z=q;e

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

build/booking.umd.cjsView on unpkg

27<span class="tmk-sr">${c}</span> L28: </div>`}function lse(t,e){t&&!t.querySelector(".tmk-spin")&&(t.innerHTML=FD(e))}function cse({rootElId:t,margin:e,bootUrl:n,initBody:r,loadMode:i="eager",loaderHtml:s=""}){const o=... L29: <div id="${o}" data-timum-owns-body style="margin: ${e}"> ... L66: </div> L67: `}async function use(t,e,n,r){let i=r==null?void 0:r.getElementById((t==null?void 0:t.rootElId)??"bookingjs");i||(i=document.getElementById((t==null?void 0:t.rootElId)??"bookingjs"... L68: L69: attempted value: ${s} L70: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... L71: const context = window.parent.document; ... L101: `),G=P.length-1,re=B.length-

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

build/booking.umd.cjsView on unpkg · L27

16* LICENSE file in the root directory of this source tree. L17: */var zM;function Wre(){if(zM)return $1;zM=1;var t=hm(),e=Symbol.for("react.element"),n=Symbol.for("react.fragment"),r=Object.prototype.hasOwnProperty,i=t.__SECRET_INTERNALS_DO_NOT... L18: .tmk-root{box-sizing:border-box;min-height:${s};display:flex;align-items:center;justify-content:center;padding:8px}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/booking.umd.cjsView on unpkg · L16

1879const kC=new LMe({projectKey:"hhinKen4c7vz6k3O3ihy",ingestPoint:"https://openreplay.timum.io/ingest",network:{capturePayload:!0},css:{scanInMemoryCSS:!0}});

Medium

Ai Review Evidence

Bundled OpenReplay is constructed with a hardcoded ingest URL at openreplay.timum.io and network payload capture.

build/booking.umd.cjsView on unpkg · L1879

build/booking-Bdwcm8KE.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/booking-Bdwcm8KE.jsView on unpkg

package.jsonView file

38"@openreplay/tracker": "^17.1.6", "@openreplay/tracker-assist": "^11.0.11", "@openreplay/tracker-profiler": "^3.0.1", "@openreplay/tracker-redux": "^4.0.1",

Medium

Ai Review Evidence

Bundled OpenReplay is constructed with a hardcoded ingest URL at openreplay.timum.io and network payload capture.

package.jsonView on unpkg · L38

91"scripts": { "analyze": "source-map-explorer 'build/booking.js' --no-border-checks", "start": "vite", "build": "vite build --config vite.config.embed.js && vite build --config vite.config.umd.js && vite build --config vite.config.component.js",

Medium

Ai Review Evidence

Bundled OpenReplay is constructed with a hardcoded ingest URL at openreplay.timum.io and network payload capture.

package.jsonView on unpkg · L91

Source & flagged code

7 flagged

build/booking.umd.cjsView file

•Credential-bearing message sent to a fixed external iframe in build/booking.umd.cjs: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... `)}function Aae({appConfig:t,muiTheme:e,fcConfig:n,iFrameStyle:r}){const i=_.useRef(null);i.current===null&&(i.current=DD("timum_booking_iframe"));const s=i.current,o=t.cdnUrl??"ht... `));const l=_.useMemo(()=>({...t,queryString:window.location.search,queryHash:window.location.hash,isComponent:!0}),[t]);return _.useEffect(()=>{const c=IT.get(s);if(c&&(!uE(c.appC... */var kN;function $ae(){return kN||(kN=1,(function(t){function e(K,X){var Z=K.length;K.push(X);e:for(;0<Z;){var q=Z-1>>>1,ee=K[q];if(0<i(ee,X))K[q]=X,K[Z]=ee,Z=q;e

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

build/booking.umd.cjsView on unpkg

27<span class="tmk-sr">${c}</span> L28: </div>`}function lse(t,e){t&&!t.querySelector(".tmk-spin")&&(t.innerHTML=FD(e))}function cse({rootElId:t,margin:e,bootUrl:n,initBody:r,loadMode:i="eager",loaderHtml:s=""}){const o=... L29: <div id="${o}" data-timum-owns-body style="margin: ${e}"> ... L66: </div> L67: `}async function use(t,e,n,r){let i=r==null?void 0:r.getElementById((t==null?void 0:t.rootElId)??"bookingjs");i||(i=document.getElementById((t==null?void 0:t.rootElId)??"bookingjs"... L68: L69: attempted value: ${s} L70: `+(o!==s?`result of cast: ${o}`:""))}return i}_cast(e,n){let r=e===void 0?e:this.transforms.reduce((i,s)=>s.call(this,i,e,this),e);return r===void 0&&(r=this.getDefault()),r}_valid... L71: const context = window.parent.document; ... L101: `),G=P.length-1,re=B.length-

High

Browser Session Account Hijack

Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.

build/booking.umd.cjsView on unpkg · L27

16* LICENSE file in the root directory of this source tree. L17: */var zM;function Wre(){if(zM)return $1;zM=1;var t=hm(),e=Symbol.for("react.element"),n=Symbol.for("react.fragment"),r=Object.prototype.hasOwnProperty,i=t.__SECRET_INTERNALS_DO_NOT... L18: .tmk-root{box-sizing:border-box;min-height:${s};display:flex;align-items:center;justify-content:center;padding:8px}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/booking.umd.cjsView on unpkg · L16

1879const kC=new LMe({projectKey:"hhinKen4c7vz6k3O3ihy",ingestPoint:"https://openreplay.timum.io/ingest",network:{capturePayload:!0},css:{scanInMemoryCSS:!0}});

Medium

Ai Review Evidence

Bundled OpenReplay is constructed with a hardcoded ingest URL at openreplay.timum.io and network payload capture.

build/booking.umd.cjsView on unpkg · L1879

build/booking-Bdwcm8KE.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/booking-Bdwcm8KE.jsView on unpkg

package.jsonView file

Lines 18-58json

18 "require": "./build/component/booking.umd.cjs"

19 }

20 },

21 "files": [

22 "build/**",

23 "public/**",

24 "README.md",

25

Lines 71-111json

71 "@fortawesome/free-solid-svg-icons": ">=6.1.1",

72 "@fortawesome/react-fontawesome": ">=0.1.18",

73 "@hookform/devtools": ">=4.2.2",

74 "@hookform/resolvers": ">=2.9.10",

75 "@mui/icons-material": ">=6.0.0 <=6.5.0",

76 "@mui/lab": ">=6.0.1-beta.36",

77 "@mui/material": ">=6.0.0 <=6.5.0",

78 "@mui/system": ">=6.0.0 <=6.5.0",

79 "@reduxjs/toolkit": ">=1.9.1",

80 "material-ui-confirm": ">=3.0.4",

81 "notistack": ">=v3.0.0-alpha.11",

82 "react": ">=18.2.0",

83 "react-dom": ">=18.2.0",

84 "react-hook-form": ">=7.33.1",

85 "react-i18next": ">=11.18.6",

86 "react-redux": ">=8.0.2"

87 },

88 "resolutions": {

89 "jest-mock": "^28.1.0"

90 },

91 "scripts": {

92 "analyze": "source-map-explorer 'build/booking.js' --no-border-checks",

93 "start": "vite",

94 "build": "vite build --config vite.config.embed.js && vite build --config vite.config.umd.js && vite build --config vite.config.component.js",

Medium

Ai Review Evidence

Bundled OpenReplay is constructed with a hardcoded ingest URL at openreplay.timum.io and network payload capture.

package.jsonView on unpkg · L91

95 "buildDev": "vite build --config vite.config.embed.js && vite build --config vite.config.umd.js && vite build --config vite.config.component.js && ./moveBundle.bat",

96 "serve": "vite preview",

97 "validate:staging": "node scripts/validate-staging-version.js",

98 "validate:aws": "node scripts/check-aws-credentials.js",

99 "bump:next-version": "node scripts/bump-next-version.js",

100 "publish:prod": "node scripts/publish-prod.js",

101 "np:preview": "np --no-cleanup --preview",

102 "np:publish": "yarn build && np --no-cleanup",

103 "s3:deleteCurrentVersionStage": "aws s3 rm \"s3://cdn.timum/bookingjs/${npm_package_current_major_version}/${npm_package_next_version}-rc\" --recursive",

104 "s3:deleteLatestStage": "aws s3 rm \"s3://cdn.timum/bookingjs/${npm_package_current_major_version}/latest-rc\" --exclude \"*\" --include \"*.*\" --recursive",

105 "cdn:purge": "node scripts/purge-cdn-cache.js",

106 "s3:publishToStage": "yarn validate:staging && yarn validate:aws && yarn build && yarn s3:deleteCurrentVersionStage && aws s3 sync ./build/ \"s3://cdn.timum/bookingjs/${npm_package_current_major_version}/${npm_package_next_version}-rc/\" --exclude \"*.map\" --cache-control \"public, max-age=300, must-revalidate\" && yarn s3:deleteLatestStage && aws s3 sync ./build/ \"s3://cdn.timum/bookingjs/${npm_package_current_major_version}/latest-rc/\" --exclude \"*.map\" --cache-control \"public, max-age=300, must-revalidate\" && node scripts/purge-cdn-cache.js bookingjs-stage",

107 "s3:deleteLatestProd": "aws s3 rm \"s3://cdn.timum/bookingjs/${npm_package_current_major_version}\" --exclude \"*\" --include \"*.*\" --exclude \"*/*\" --recursive",

108 "s3:publishToProdWithoutBuild": "echo '⚠️ WARNING: Publishing without build - ensure build/ is current!' && yarn validate:aws && np --no-yarn --no-cleanup && aws s3 sync ./build/ \"s3://cdn.timum/bookingjs/${npm_package_current_major_version}/${npm_package_next_version}/\" --exclude \"*.map\" --cache-control \"public, max-age=31536000, immutable\" && yarn s3:deleteLatestProd && aws s3 sync ./build/ \"s3://cdn.timum/bookingjs/${npm_package_current_major_version}/\" --exclude \"*.map\" --cache-control \"public, max-age=300, must-revalidate\" && node scripts/purge-cdn-cache.js bookingjs-prod ...

109 "s3:publishToProdWithoutNP": "echo '⚠️ WARNING: Publishing without npm - version may be out of sync!' &&

110 "test": "vitest --project=unit run",

111 "test:unit": "vitest --project=unit run",

Long lines were clipped for display.