This widget calls one API route. The bundle knows about more than one.
Goal: find the endpoint the UI never calls and read the flag from it.
Open /JSRECON/js/l1.app.js. Every string the bundle uses lives in one array at the top, then a loader rotates that array before anything runs.
Do not rotate it by hand. Paste the first line plus the rotation IIFE into the DevTools console and print _0x41ab, or call _0x2f(0) ... _0x2f(10) and read every value.
One of the decoded strings is a second *.php filename under the same api/v1/ directory. Request it in the browser.