registry / ctt-babylon / 0.25.2
ctt-babylon@0.25.2
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe inspected source shows user-triggered browser behaviors and an exposed API key, but no install hook, persistence, secret harvesting, or covert exfiltration. Because analysis coverage is incomplete and the embedded key is a real residual concern, downgrade to a warning rather than mark clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user logs into the style panel or clicks an application-configured external link.
Impact
The embedded key may be abused outside the package; configured links can navigate users to arbitrary destinations.
Mechanism
Browser request to Google Fonts and user-triggered external navigation.
AI rationale
The inspected source shows user-triggered browser behaviors and an exposed API key, but no install hook, persistence, secret harvesting, or covert exfiltration. Because analysis coverage is incomplete and the embedded key is a real residual concern, downgrade to a warning rather than mark clean.
Evidence
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsesm2022/lib/services/color-panel.service.mjsesm2022/lib/directives/link-type/link-type.directive.mjs
Network endpoints1
www.googleapis.com
Decision evidence
public snapshotAI called this Suspicious at 66.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package embeds a Google API key and uses it to request the Google Web Fonts API after the style-panel login succeeds.
- The link directive opens an externally supplied URL in a new browser tab when a user clicks an external link.
- The manifest exposes browser module entry points, so these behaviors run only when the library is imported by an application.
Evidence against
- There are no install or lifecycle scripts in the manifest.
- The observed network request is a Google Fonts catalog request, and the redirect behavior is an explicit user-click link feature.
- No credential exfiltration, shell execution, dynamic code evaluation, or filesystem access was found in the inspected source.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggedesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView file
16patternName = google_api_key
severity = high
line = 16
High
High Secret
Package contains a high-severity secret pattern.
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1616patternName = google_api_key
severity = high
line = 16
High
Secret Pattern
Google API key in esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1644async login() {
if (isPlatformBrowser(this.platformId)) {
const { email, password } = this.loginForm.value;
if (email === this.userPanelInternal &&
password === this.passPanelInternal) {
this.loginHecho = true;
sessionStorage.setItem('panel-login-ok', 'true');
const variables = this.colorService.getAllCSSVariables();
this.groupedVariables =
this.colorService.groupByCategory(variables);
await this.colorService.fetchGoogleFonts(this.googleFontsAp
Findings
1 Critical3 High5 Medium3 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
HighHigh Secretesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
HighSemantic Analysis Limitedpackage.json
HighSecret Patternesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumAi Review Evidenceesm2022/lib/services/color-panel.service.mjs
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ctt-babylon@0.25.2.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.25.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.