registry / ctt-babylon / 0.25.15
ctt-babylon@0.25.15
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source shows package-aligned Angular UI and booking functionality without a concrete malicious chain. Browser script loading and advertising cookie handling do not establish malware or credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Application component initialization and browser interactions; no automatic npm installation hook is declared.
Impact
Ordinary browser navigation and widget integration; no malicious execution, credential theft, or project mutation was established.
Mechanism
Components open supplied links, load booking integration scripts, and pass attribution data to booking widgets.
AI rationale
Inspected source shows package-aligned Angular UI and booking functionality without a concrete malicious chain. Browser script loading and advertising cookie handling do not establish malware or credential exfiltration.
Network endpoints2
api.spalopia.app/utbapis/utbinsert/load.phpajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares Angular library entrypoints, only tslib as a runtime dependency, and no lifecycle hooks or self-dependency.
- The flagged link directive opens caller-provided browser links through click handling.
- External booking scripts load during browser component initialization, gated by supplied booking markup.
- The booking widget reads advertising attribution cookies and dispatches marketing parameters to its widget; no session credential forwarding was identified.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggedesm2022/lib/directives/link-type/link-type.directive.mjsView file
138? detected.value
L139: : 'https://' + detected.value.replace(/^\/+/, '');
L140: try {
L141: window.open(finalUrl, '_blank');
L142: }
...
L344: }] } });
L345: //# sourceMappingURL=data:application/json;base64,[redacted]...
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
esm2022/lib/directives/link-type/link-type.directive.mjsView on unpkg · L138136const isAbsoluteUrl = (url) => /^(https?:)/i.test(url);
const finalUrl = isAbsoluteUrl(detected.value)
? detected.value
: 'https://' + detected.value.replace(/^\/+/, '');
try {
window.open(finalUrl, '_blank');
Low
Ai Review Evidence
The flagged link directive opens caller-provided browser links through click handling.
esm2022/lib/directives/link-type/link-type.directive.mjsView on unpkg · L136fesm2022/ctt-babylon.mjsView file
Findings
1 Critical3 Medium8 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceesm2022/lib/directives/link-type/link-type.directive.mjs
LowAi Review Evidenceesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
LowAi Review Evidenceesm2022/lib/components/core/babylon-booking-widget/babylon-booking-widget.component.mjs
LowAi Review Evidenceesm2022/lib/components/core/babylon-booking-widget/babylon-booking-widget.component.mjs
Affected versions and remediation
This report applies to ctt-babylon@0.25.15.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.25.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.