registry / ctt-babylon / 0.26.21
ctt-babylon@0.26.21
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe scanner's redirect finding is not supported by the inspected directive: it handles application-provided link destinations and does not add identity material or redirect to a publisher-selected host. The mapper's URL check gates diagnostic logging, and the inspected tslib dependency is ordinary TypeScript runtime code.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer renders an element using the link directive and the user clicks it; mapper logging occurs only when mapping data while the browser URL contains “mapper.”
Impact
No confirmed attack surface was established in the inspected behavior.
Mechanism
The directive applies supplied link destinations and handles telephone, email, address, anchor, and component links. The mapper conditionally logs mapped results; no identity forwarding or publisher-selected redirect was found in the inspected paths.
AI rationale
The scanner's redirect finding is not supported by the inspected directive: it handles application-provided link destinations and does not add identity material or redirect to a publisher-selected host. The mapper's URL check gates diagnostic logging, and the inspected tslib dependency is ordinary TypeScript runtime code.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has no lifecycle scripts and exposes its Angular library through module entrypoints; its runtime dependency is tslib.
- The flagged link directive routes according to its supplied link type and href, with external links using the supplied URL and ordinary phone, email, and address handling.
- The mapper's conditional browser logging runs only when the current URL contains “mapper”; it logs mapped data for debugging.
- The inspected tslib files contain TypeScript helper code, and its manifest identifies it as a runtime library.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggedesm2022/lib/directives/link-type/link-type.directive.mjsView file
139? detected.value
L140: : 'https://' + detected.value.replace(/^\/+/, '');
L141: try {
L142: window.open(finalUrl, '_blank');
L143: }
...
L345: }] } });
L346: //# sourceMappingURL=data:application/json;base64,[redacted]...
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
esm2022/lib/directives/link-type/link-type.directive.mjsView on unpkg · L139288applyNormalizedHref(detected) {
const el = this.elRef.nativeElement;
const isAnchor = el.tagName.toLowerCase() === 'a';
if (!isAnchor)
return;
switch (detected.kind) {
case 'phone':
el.setAttribute('href', `tel:${detected.value}`);
el.removeAttribute('target');
break;
case 'email':
el.setAttribute('href', `mailto
Low
Ai Review Evidence
The flagged link directive routes according to its supplied link type and href, with external links using the supplied URL and ordinary phone, email, and address handling.
esm2022/lib/directives/link-type/link-type.directive.mjsView on unpkg · L288Findings
1 Critical3 Medium8 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidenceesm2022/lib/directives/link-type/link-type.directive.mjs
LowAi Review Evidenceesm2022/lib/directives/link-type/link-type.directive.mjs
LowAi Review Evidenceesm2022/lib/services/mapper/mapper.service.mjs
LowAi Review Evidence.lpm-dependency-evidence-524c49f9-9021-441a-b604-724b6f18ab28/0/npm-linux/package.json
Affected versions and remediation
This report applies to ctt-babylon@0.26.21.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.26.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.