ctt-babylon@0.25.8
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains unsafe script execution primitives and unpinned third-party script loaders, creating a critical consumer-side risk. The evidence supports a warning rather than malicious intent because activation is component-specific and no install-time or covert malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders one of these browser components; iframe execution additionally requires an HTML-valued frameUrl input.
Impact
A compromised remote host or untrusted embed value can run JavaScript in the consuming application's origin.
Mechanism
Unsanitized HTML script re-execution and unpinned remote script loading.
AI rationale
The package contains unsafe script execution primitives and unpinned third-party script loaders, creating a critical consumer-side risk. The evidence supports a warning rather than malicious intent because activation is component-specific and no install-time or covert malicious behavior was found.
Evidence
esm2022/lib/components/core/babylon-iframe/babylon-iframe.component.mjsesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjsesm2022/lib/components/core/babylon-booking-widget/babylon-booking-widget.component.mjsesm2022/lib/services/babylon-widget-search-loader.service.mjs
Network endpoints3
api.spalopia.app/utbapis/utbinsert/load.phpajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.jswidget-engine.b-cdn.net/widget.min.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The iframe component turns an HTML-valued input into DOM content and replaces script tags with executable scripts.
- The external-script component bypasses HTML trust checks and loads an unpinned script from a third-party host when rendered with a matching input.
- The booking widget automatically loads and executes an unpinned remote widget after that component is rendered in a browser.
Evidence against
- package.json has no lifecycle scripts or self-dependency.
- The risky behavior is confined to opt-in browser components for embeds and booking widgets; no credential harvesting or package-install mutation was found.
- The flagged link directive only opens consumer-supplied external links after a user click.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggedesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView file
16patternName = google_api_key
severity = high
line = 16
High
High Secret
Package contains a high-severity secret pattern.
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L1616patternName = google_api_key
severity = high
line = 16
High
Secret Pattern
Google API key in esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
esm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjsView on unpkg · L16esm2022/lib/directives/link-type/link-type.directive.mjsView file
Findings
1 Critical3 High5 Medium3 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
HighHigh Secretesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
HighSemantic Analysis Limitedpackage.json
HighSecret Patternesm2022/lib/components/core/babylon-color-picker/babylon-color-picker.component.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceesm2022/lib/components/core/babylon-iframe/babylon-iframe.component.mjs
MediumAi Review Evidenceesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ctt-babylon@0.25.8.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.25.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.