ctt-babylon@0.26.33
This library was generated with [Angular CLI](https://github.com/angular/angular-cli) version 17.3.0.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source does not establish malicious data theft, but the booking integration sets analytics consent to true without an evident user-consent control. This is an undisclosed runtime telemetry risk.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The browser component initializes when its supplied markup contains the expected booking container.
Impact
The booking integration may enable analytics tracking without the host application's user's consent.
Mechanism
It loads the booking runtime and sets Google Analytics and GA4 consent status to true, with no consent input exposed by the component.
AI rationale
The source does not establish malicious data theft, but the booking integration sets analytics consent to true without an evident user-consent control. This is an undisclosed runtime telemetry risk.
Evidence
esm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
Network endpoints3
ajax.googleapis.comapi.spalopia.app163-f1401372.bysiana.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The browser component sets Google Analytics and GA4 cookie-consent status to true without exposing a consent setting in its inputs.
- When the component receives the expected booking markup, it loads the SpaLopia booking runtime and initializes the booking widget.
- The flagged link directive opens the supplied external URL in response to a click.
Evidence against
- The analytics setting is part of an external spa-booking widget integration, and the code disables Facebook and Fullstory.
- The link directive uses the configured target; no identity or credential material is added to the URL.
Behavioral surface
Network
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flaggedesm2022/lib/directives/link-type/link-type.directive.mjsView file
139? detected.value
L140: : 'https://' + detected.value.replace(/^\/+/, '');
L141: try {
L142: window.open(finalUrl, '_blank');
L143: }
...
L345: }] } });
L346: //# sourceMappingURL=data:application/json;base64,[redacted]...
Critical
Browser Phishing Redirect
Source redirects browser users to an external URL carrying identity material.
esm2022/lib/directives/link-type/link-type.directive.mjsView on unpkg · L139139? detected.value
: 'https://' + detected.value.replace(/^\/+/, '');
try {
window.open(finalUrl, '_blank');
}
catch (e)
Medium
Ai Review Evidence
The flagged link directive opens the supplied external URL in response to a click.
esm2022/lib/directives/link-type/link-type.directive.mjsView on unpkg · L139fesm2022/ctt-babylon.mjsView file
Findings
1 Critical6 Medium3 Low
CriticalBrowser Phishing Redirectesm2022/lib/directives/link-type/link-type.directive.mjs
MediumNetwork
MediumOversized Source Filefesm2022/ctt-babylon.mjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidenceesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
MediumAi Review Evidenceesm2022/lib/components/core/babylon-external-script/babylon-external-script.component.mjs
MediumAi Review Evidenceesm2022/lib/directives/link-type/link-type.directive.mjs
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to ctt-babylon@0.26.33.
See all versions of ctt-babylon for other recorded verdicts.
- Review the evidence and your use of ctt-babylon@0.26.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.