registry / ctt-babylon / 0.24.43
ctt-babylon@0.24.43
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection shows an Angular UI component library with user-invoked link, download, and styling functions, not an install-time or covert execution/exfiltration chain. The embedded Google Fonts key is a security hygiene concern, but its sole observed use is the intended public font API.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Runtime user interaction: clicking configured links or enabling and using the style panel.
Impact
Configured external URLs can be opened and Google font metadata/styles loaded, consistent with UI-library behavior.
Mechanism
User-invoked navigation, asset download, and Google Fonts loading.
AI rationale
Direct inspection shows an Angular UI component library with user-invoked link, download, and styling functions, not an install-time or covert execution/exfiltration chain. The embedded Google Fonts key is a security hygiene concern, but its sole observed use is the intended public font API.
Evidence
package.jsonesm2022/lib/directives/link-type/link-type.directive.mjsesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsesm2022/lib/services/color-panel.service.mjsesm2022/lib/components/core/babylon-lis-c2-img-vid-dl/babylon-lis-c2-img-vid-dl.component.mjsesm2022/lib/components/core/babylon-lis-c4-txt-img-pdf/babylon-lis-c4-txt-img-pdf.component.mjs
Network endpoints3
www.googleapis.com/webfonts/v1/webfontsfonts.googleapis.com/css2www.google.com/maps/search/
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- A browser-visible Google Fonts API key is embedded in the color-picker component.
Evidence against
- package.json has no lifecycle scripts or executable bin entry.
- Link directive opens only caller-supplied external links after a user click.
- Color-picker password is compared locally; no credential transmission is present.
- Google Fonts requests are limited to font metadata/stylesheets.
- fetch use downloads user-selected image/PDF URLs only.
- No child-process, eval, environment harvesting, cookie access, or persistence found.
Behavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggedesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView file
16patternName = google_api_key
severity = high
line = 16
matchedText = this.goo...MA';
High
High Secret
Package contains a high-severity secret pattern.
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1616patternName = google_api_key
severity = high
line = 16
matchedText = this.goo...MA';
High
Secret Pattern
Google API key in esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L16esm2022/lib/directives/link-type/link-type.directive.mjsView file
Findings
2 Critical2 High3 Medium3 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
CriticalPrevious Version Dangerous Deltaesm2022/lib/directives/link-type/link-type.directive.mjs
HighHigh Secretesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
HighSecret Patternesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to ctt-babylon@0.24.43.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.24.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.