ctt-babylon@0.24.59
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not malicious package behavior, but it exposes a concrete XSS/remote-script execution capability to consuming applications. The scanner's redirect and API-key findings are normal user-invoked link/font functionality.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A host application renders `lib-babylon-iframe` with HTML or renders the booking/external-script components.
Impact
Attacker-controlled host content or a compromised remote script can run JavaScript in the host page origin.
Mechanism
Unsanitized HTML script reactivation and third-party script injection.
AI rationale
This is not malicious package behavior, but it exposes a concrete XSS/remote-script execution capability to consuming applications. The scanner's redirect and API-key findings are normal user-invoked link/font functionality.
Evidence
package.jsonesm2022/lib/components/core/babylon-iframe/babylon-iframe.component.mjsesm2022/lib/components/core/babylon-booking-widget/babylon-booking-widget.component.mjsesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjsesm2022/lib/services/babylon-widget-search-loader.service.mjsesm2022/lib/directives/link-type/link-type.directive.mjsesm2022/lib/services/color-panel.service.mjs
Network endpoints3
widget-engine.b-cdn.net/widget.min.jsapi.spalopia.app/utbapis/utbinsert/load.phpajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- `babylon-iframe` executes scripts embedded in its `frameUrl` input.
- Booking widget loads remote JavaScript at runtime.
- External-script component trusts input HTML and loads third-party scripts.
Evidence against
- `package.json` has no lifecycle scripts or bin entrypoint.
- Execution is browser-only and requires component rendering.
- No credential, environment, filesystem, or install-time harvesting found.
Behavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
4 flaggedesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView file
16patternName = google_api_key
severity = high
line = 16
matchedText = this.goo...MA';
High
High Secret
Package contains a high-severity secret pattern.
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1616patternName = google_api_key
severity = high
line = 16
matchedText = this.goo...MA';
High
Secret Pattern
Google API key in esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L16esm2022/lib/directives/link-type/link-type.directive.mjsView file
Findings
1 Critical2 High3 Medium3 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
HighHigh Secretesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
HighSecret Patternesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to ctt-babylon@0.24.59.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.24.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.