registry / ctt-babylon / 0.24.74
ctt-babylon@0.24.74
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection found a hard-coded Google Fonts API key and normal browser UI behavior, but no concrete malicious chain. The scanner's redirect and secret findings describe package-aligned, user-invoked functionality rather than phishing or exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A host application renders the styling panel or a user clicks an external link.
Impact
No unconsented data collection, code execution, persistence, or install-time mutation was found.
Mechanism
Browser-side font loading and user-invoked link navigation.
AI rationale
Direct inspection found a hard-coded Google Fonts API key and normal browser UI behavior, but no concrete malicious chain. The scanner's redirect and secret findings describe package-aligned, user-invoked functionality rather than phishing or exfiltration.
Evidence
package.jsonesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsesm2022/lib/services/color-panel.service.mjsesm2022/lib/directives/link-type/link-type.directive.mjs
Network endpoints2
www.googleapis.com/webfonts/v1/webfonts?key=${apiKey}fonts.googleapis.com/css2?family=${formattedFont}&display=swap
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- A Google Fonts API key is embedded in client-side code.
- The styling panel can be enabled by a browser query parameter and uses caller-provided credentials.
- External links are opened only after a user click and use the configured link value.
Evidence against
- package.json has no lifecycle scripts, bin entry, or install-time executable.
- The only confirmed network call retrieves Google Fonts metadata for the styling panel.
- No credential submission, environment or file harvesting, shell execution, dynamic code execution, or persistence was found.
Behavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggedesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView file
16patternName = google_api_key
severity = high
line = 16
matchedText = this.goo...MA';
High
High Secret
Package contains a high-severity secret pattern.
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1616patternName = google_api_key
severity = high
line = 16
matchedText = this.goo...MA';
High
Secret Pattern
Google API key in esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1614this.userPanelInternal = '';
this.passPanelInternal = '';
this.googleFontsApiKey = 'AIza[redacted]';
this.mostrarPanel = false;
Findings
1 Critical2 High3 Medium6 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
HighHigh Secretesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
HighSecret Patternesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidenceesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
LowAi Review Evidenceesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
Affected versions and remediation
This report applies to ctt-babylon@0.24.74.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.24.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.