registry  /  @adatechnology/fiscal-provider  /  0.1.0

@adatechnology/fiscal-provider@0.1.0

Emissão de documentos fiscais brasileiros direto na SEFAZ, sem intermediários: NFC-e (65), NF-e (55), NFS-e (ABRASF), CT-e (57) e SAT. Assinatura A1, IBS/CBS da Reforma Tributária (NT 2025.002), QR Code, DANFE/DANFCE em PDF, cancelamento e verificação — T

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Runtime fiscal requests disable TLS peer verification for mTLS connections. This can permit an on-path attacker to impersonate configured HTTPS fiscal endpoints and observe or alter transaction traffic.

Static reason
No blocking static signals were detected.
Trigger
A consumer calls an NFC-e, NF-e, or CT-e operation that contacts SEFAZ.
Impact
Potential interception or manipulation of fiscal request and response data on a hostile network.
Mechanism
HTTPS mTLS request with certificate verification disabled.
Rationale
The package appears aligned with its documented fiscal-provider purpose and shows no malicious execution, persistence, or exfiltration behavior. Its explicit TLS-verification bypass is a material transport-security vulnerability, so it should be warned rather than treated as clean.
Evidence
package.jsondist/index.jsREADME.md
Network endpoints4
nfe.fazenda.sp.gov.brnfe.svrs.rs.gov.brbrasilapi.com.br/api/cnpj/v1/receitaws.com.br/v1/cnpj/

Decision evidence

public snapshot
AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
  • `dist/index.js` disables TLS certificate verification (`rejectUnauthorized: false`) for SEFAZ mTLS requests.
  • The disabled verification applies during user-invoked fiscal SOAP operations, creating a network MITM integrity risk.
Evidence against
  • `package.json` has no preinstall, install, or postinstall hooks.
  • The published package contains only `dist` artifacts and type declarations.
  • `dist/index.js` imports no filesystem or child-process modules and contains no file-write or shell-execution primitives.
  • Network requests implement documented fiscal-provider functions, including SEFAZ SOAP, SAT/NFS-e configured URLs, and public CNPJ lookups.
  • `MOCK_SEFAZ_URL` is a test override rather than credential harvesting or exfiltration.
  • No AI-agent configuration, persistence, remote payload loading, or destructive behavior was found.
Behavioral surface
Source
CryptoEnvironmentVarsNetwork
Supply chain
HighEntropyStringsObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 212 KB of source, external domains: brasilapi.com.br, cte-homologacao.svrs.rs.gov.br, cte.fazenda.mg.gov.br, cte.fazenda.pr.gov.br, cte.sefaz.mt.gov.br, cte.svrs.rs.gov.br, github.com, hcte.fazenda.mg.gov.br, hnfe.fazenda.mg.gov.br, hom1.nfe.fazenda.gov.br, homologacao.cte.fazenda.pr.gov.br, homologacao.cte.ms.gov.br, homologacao.nfce.fazenda.sp.gov.br, homologacao.nfe.fazenda.sp.gov.br, homologacao.nfe.sefa.pr.gov.br, homologacao.sefaz.mt.gov.br, nfce.fazenda.sp.gov.br, nfe-homologacao.sefazrs.rs.gov.br, nfe-homologacao.svrs.rs.gov.br, nfe.fazenda.mg.gov.br, nfe.fazenda.sp.gov.br, nfe.sefa.pr.gov.br, nfe.sefazrs.rs.gov.br, nfe.svrs.rs.gov.br, portalsped.fazenda.mg.gov.br, producao.cte.ms.gov.br, receitaws.com.br, www.abrasf.org.br, www.homologacao.nfce.fazenda.gov.br, www.homologacao.nfce.fazenda.sp.gov.br, www.nfce.fazenda.gov.br, www.nfce.fazenda.sp.gov.br, www.nfe.sefa.pr.gov.br, www.portalfiscal.inf.br, www.sefaz.rs.gov.br, www.siscomex.gov.br, www.w3.org, www1.nfe.fazenda.gov.br

Source & flagged code

1 flagged · loading source
package.jsonView file
•Published source reference
Medium
Stripped Provenance Metadata

`dist/index.js` disables TLS certificate verification (`rejectUnauthorized: false`) for SEFAZ mTLS requests.

package.jsonView on unpkg

Findings

4 Medium4 Low
MediumNetwork
MediumEnvironment Vars
MediumStripped Provenance Metadatapackage.json
MediumAi Review Evidence
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings