registry / ctt-babylon / 0.25.6
ctt-babylon@0.25.6
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an Angular UI library with no lifecycle hooks or Node-side execution path. The scanner findings correspond to user-click navigation and an optional authenticated style-panel font request, not malicious behaviour.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user clicks a configured external link or logs into the optional style panel.
Impact
The application may open configured links or request the Google Fonts catalogue; no package-host compromise or data exfiltration was found.
Mechanism
User-invoked external navigation and font catalogue retrieval.
AI rationale
This is an Angular UI library with no lifecycle hooks or Node-side execution path. The scanner findings correspond to user-click navigation and an optional authenticated style-panel font request, not malicious behaviour.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- A click-handling browser directive opens a configured external URL in a new tab.
- The optional style panel fetches the Google Fonts catalogue only after its login succeeds.
- The manifest has no lifecycle scripts and declares only tslib as a runtime dependency.
Evidence against
- No install-time execution, self-dependency, Node process access, shell execution, or dynamic code evaluation was found.
- The external navigation is initiated by a user click and uses the supplied link value.
- The observed network request is a Google Fonts catalogue request, not credential or data exfiltration.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggedesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView file
16patternName = google_api_key
severity = high
line = 16
High
High Secret
Package contains a high-severity secret pattern.
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1616patternName = google_api_key
severity = high
line = 16
High
Secret Pattern
Google API key in esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1644async login() {
if (isPlatformBrowser(this.platformId)) {
const { email, password } = this.loginForm.value;
if (email === this.userPanelInternal &&
password === this.passPanelInternal) {
this.loginHecho = true;
sessionStorage.setItem('panel-login-ok', 'true');
const variables = this.colorService.getAllCSSVariables();
this.groupedVariables =
this.colorService.groupByCategory(variables);
await this.colorService.fetchGoogleFonts(this.googleFontsAp
Findings
1 Critical3 High3 Medium5 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
HighHigh Secretesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
HighSemantic Analysis Limitedpackage.json
HighSecret Patternesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowAi Review Evidenceesm2022/lib/directives/link-type/link-type.directive.mjs
LowAi Review Evidenceesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
Affected versions and remediation
This report applies to ctt-babylon@0.25.6.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.25.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.