ctt-babylon@0.24.77
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a user-invoked but dangerous remote-script and trusted-HTML capability. It is not concrete autonomous malware, so it should be warned rather than blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
An application renders lib-babylon-external-script with script input containing utb-iframe-spa.
Impact
Remote script code can run in the hosting application's browser context.
Mechanism
Trusted HTML bypass plus injected remote script elements.
AI rationale
The package contains a user-invoked but dangerous remote-script and trusted-HTML capability. It is not concrete autonomous malware, so it should be warned rather than blocked.
Evidence
esm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
Network endpoints3
ajax.googleapis.comapi.spalopia.app160-f1401372.engine.arimahotel.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A browser component marks caller-supplied HTML as trusted.
- When that component receives a matching input, it injects and runs remote scripts from fixed third-party hosts.
Evidence against
- The manifest has no install or lifecycle scripts.
- The risky path requires the application to render the specific component with a matching input; it is not package-install behavior.
Behavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
7 flaggedesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView file
16patternName = google_api_key
severity = high
line = 16
High
High Secret
Package contains a high-severity secret pattern.
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1616patternName = google_api_key
severity = high
line = 16
High
Secret Pattern
Google API key in esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L16esm2022/lib/directives/link-type/link-type.directive.mjsView file
Findings
1 Critical3 High5 Medium3 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
HighHigh Secretesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
HighSemantic Analysis Limitedpackage.json
HighSecret Patternesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
MediumAi Review Evidenceesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ctt-babylon@0.24.77.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.24.77 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.