@aifinpay/agent@2.10.0
AiFinPay SDK for global Agent Passport identity and route-verified AIFP-1/AIFP-2 settlement for autonomous AI agents.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe reviewed code sends runtime usage metadata to the package service by default, while the README does not disclose that reporting; the available opt-out does not make undisclosed runtime telemetry clean. The wallet-transfer finding is not confirmed: bridge execution is a caller-invoked method, and no automatic transfer was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer invokes a call that reaches a telemetry reporting branch; telemetry is enabled by default.
Impact
The service can learn provider, chain, and cost or free-call activity associated with the agent ID.
Mechanism
The SDK sends agent ID, event metadata, and timestamp to the configured base URL’s `/api/telemetry` endpoint.
AI rationale
The reviewed code sends runtime usage metadata to the package service by default, while the README does not disclose that reporting; the available opt-out does not make undisclosed runtime telemetry clean. The wallet-transfer finding is not confirmed: bridge execution is a caller-invoked method, and no automatic transfer was identified.
Evidence
dist/unifiedAgent.js
Network endpoints1
aifinpay.io/api/telemetry (default base URL; base URL is configurable)
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Telemetry is enabled by default unless `opts.telemetry` is explicitly set to `false`.
- A user-invoked call can send provider, chain, cost, and free-call status as telemetry.
- Telemetry is posted to `${this.inner.baseUrl}/api/telemetry` with the agent ID and timestamp; the package documentation does not disclose this runtime reporting.
Evidence against
- The telemetry code says it sends no body content, and provides an opt-out.
- Bridge transactions are submitted through an explicit `bridgeExecute(quote)` call; the reviewed code does not show automatic fund transfers.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/unifiedAgent.jsView file
16import { createPublicClient, createWalletClient, http, keccak256, toHex, toFunctionSelector, formatEther, } from "viem";
L17: import { privateKeyToAccount } from "viem/accounts";
L18: import { viemWalletClientWallet } from "./agentWallet.js";
...
L173: const TRANSPORT_OVERRIDE = {
L174: polygon: { defaultRpc: "https://polygon.drpc.org" },
L175: botchain: { defaultRpc: "https://rpc.botchain.ai", explorer: "https://scan.botchain.ai" },
...
L328: // Ordering it the other way — as 1.3.2 shipped — makes the default base fetch
L329: // the SPA shell and die inside JSON.parse.
L330: const DEFAULT_REGISTRY_PATHS = ["/api/providers", "/providers"];
...
L376: this.polygonRpc = opts.polygonRpc ?? opts.evmRpcUrls?.polygon ?? "https://polygon.drpc.org";
L377: this.solanaRpc = opts.solanaRpc ?? pro
Critical
Wallet Drain
Source uses private key material to transfer cryptocurrency funds.
dist/unifiedAgent.jsView on unpkg · L1616Trigger-reachable chain: manifest.main -> dist/index.js -> dist/unifiedAgent.js
L16: import { createPublicClient, createWalletClient, http, keccak256, toHex, toFunctionSelector, formatEther, } from "viem";
L17: import { privateKeyToAccount } from "viem/accounts";
L18: import { viemWalletClientWallet } from "./agentWallet.js";
...
L173: const TRANSPORT_OVERRIDE = {
L174: polygon: { defaultRpc: "https://polygon.drpc.org" },
L175: botchain: { defaultRpc: "https://rpc.botchain.ai", explorer: "https://scan.botchain.ai" },
...
L328: // Ordering it the other way — as 1.3.2 shipped — makes the default base fetch
L329: // the SPA shell and die inside JSON.parse.
L330: const DEFAULT_REGISTRY_PATHS = ["/api/providers", "/providers"];
...
L376: this.polygonRpc = opts.polygonRpc ?? opts.evmRpcUrls?.pol
Findings
2 Critical1 High4 Medium5 Low
CriticalWallet Draindist/unifiedAgent.js
CriticalTrigger Reachable Dangerous Capabilitydist/unifiedAgent.js
HighSemantic Analysis Limiteddist/crossChain.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/unifiedAgent.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @aifinpay/agent@2.10.0.
See all versions of @aifinpay/agent for other recorded verdicts.
- Review the evidence and your use of @aifinpay/agent@2.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.