registry  /  rebill  /  1.17.30

rebill@1.17.30

Stencil Component Starter

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface. At runtime, the browser checkout component makes package-aligned payment requests and can inject CSS/JS explicitly supplied by its host application.

Static reason
No blocking static signals were detected.
Trigger
A host application imports/mounts the Rebill checkout component and supplies checkout configuration.
Impact
Normal checkout/API activity; no package-driven credential harvesting, persistence, destructive action, or remote payload chain was found.
Mechanism
Browser payment SDK using configured Rebill APIs and host-provided component customization.
Rationale
Direct inspection shows a browser-oriented payment SDK with configured Rebill API/CDN endpoints and no install-time execution beyond Husky prepare. The flagged eval and script injection are bounded to Lottie animation handling and explicit host-provided checkout customization, respectively; neither establishes a package-driven malicious chain.
Evidence
package.jsondist/cjs/config-Y3tTYUmX.jsdist/components/rebill-checkout.jsdist/cjs/lottie-NxKK9TIf.jsdist/index.cjs.jsdist/index.jsdist/cjs/index.cjs.jsdist/cjs/cdn-Ds5e17wp.jsdist/cjs/card-fields-wrapper_16.cjs.entry.js
Network endpoints5
api.rebill.dev/v3api.rebill.com/v3sdk-iframe.rebill.dev/v3-1/index.htmlsdk-iframe.rebill.to/v3-1/index.htmlunpkg.com/rebill@${PACKAGE_VERSION}/assets/

Decision evidence

public snapshot
AI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for block
  • dist/components/rebill-checkout.js supports host-supplied CSS/JS DOM injection.
  • dist/cjs/lottie-NxKK9TIf.js contains vendor Lottie eval for animation expressions.
Evidence against
  • package.json has only prepare: husky install; no preinstall/install/postinstall hook.
  • Published files contain no Node filesystem, child-process, shell, or AI-agent-control access.
  • dist/cjs/config-Y3tTYUmX.js defines Rebill payment API endpoints and environments.
  • Custom JS injection runs only when the host supplies the checkout component js property.
  • The eval is confined to bundled Lottie expression handling, not a downloaded payload path.
Behavioral surface
Source
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 528 file(s), 17.3 MB of source, external domains: api.rebill.com, api.rebill.dev, bugs.chromium.org, bugs.webkit.org, cdnjs.cloudflare.com, chat.stenciljs.com, css-tricks.com, developer.chrome.com, developer.mozilla.org, docs.stripe.com, ecma-international.org, eev.ee, ejohn.org, en.wikipedia.org, es5.github.io, flattr.com, github.com, html.spec.whatwg.org, js.stripe.com, jspdf.default.namespaceuri, lodash.com, mathiasbynens.be, mdn.io, mths.be, npms.io, openjsf.org, opensource.org, pastebin.com, peter.michaux.ca, sdk-iframe.rebill.dev, sdk-iframe.rebill.to, stackoverflow.com, stenciljs.com, tc39.es, underscorejs.org, unpkg.com, v3.docs.rebill.com, webpjs.appspot.com, wonko.com, www.ecma-international.org, www.google.com, www.html5rocks.com, www.i18next.com, www.npmjs.com, www.pagofacil.com.ar, www.phpied.com, www.quasimondo.com, www.rebill.com, www.w3.org

Source & flagged code

1 flagged · loading source
dist/rebill/p-GK75wIKe.jsView file
8License: MIT, header required. L9: */var Matrix=function(){var t=Math.cos;var i=Math.sin;var e=Math.tan;var r=Math.round;function s(){this.props[0]=1;this.props[1]=0;this.props[2]=0;this.props[3]=0;this.props[4]=0;t... L10: //# sourceMappingURL=p-GK75wIKe.js.map
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/rebill/p-GK75wIKe.jsView on unpkg · L8

Findings

4 Medium8 Low
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/rebill/p-GK75wIKe.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings