@alicloud-panxi/aicoach-sdk@1.1.48: Malicious npm security report

AI Security Review

scanned 2h ago · by lpm-firewall-ai

During SDK runtime error paths, the package sends diagnostic records and credentials to a hardcoded remote endpoint. No install-time behavior was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

RTC channel join or WebSocket creation failure while using the SDK

Impact

Exposes RTC/WebSocket tokens, session details, user identifier, URL, and browser metadata to the receiver.

Mechanism

Hardcoded telemetry POST containing runtime tokens and environment data

Attack narrative

The bundled runtime defines a telemetry helper that creates an environment record and POSTs it to a hardcoded endpoint. Error handlers invoke it with RTC `token` and WebSocket `channelToken` values, alongside channel/session and URL data. This occurs as part of normal runtime failure handling and has no documented opt-in or redaction.

Rationale

The package contains a concrete credential-exfiltration path: sensitive runtime tokens are passed to a hardcoded external telemetry receiver. Absence of lifecycle hooks limits the trigger but does not remove the runtime exposure.

Evidence

dist/index.es.jspackage.jsonreadme.md

Network endpoints1

monitor-evobuniqan.cn-hangzhou.fcapp.run/log

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Runtime telemetry collects user ID, user agent, current URL, version data, and arbitrary event logs.
The telemetry routine POSTs records to a hardcoded external Function Compute endpoint.
An RTC error handler includes its channel token in the telemetry log.
A WebSocket error handler includes channelToken and its URL in telemetry.

Evidence against

package.json has no npm lifecycle hooks.
The observed collection is runtime error telemetry, not install-time execution.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 6.13 MB of source, external domains: account.console.aliyun.com, arms-retcode-daily.alibaba.net, arms-retcode-daily.aliyun.test, arms-retcode-hz-finance.aliyuncs.com, arms-retcode-sg.aliyuncs.com, arms-retcode-sg.orientalgame.com.tw, arms-retcode.aliyuncs.com, arms-retcode.orientalgame.com.tw, axios-http.com, cli.vuejs.org, fb.me, g.alicdn.com, github.com, gw.alicdn.com, img.alicdn.com, link.vuejs.org, monitor-evobuniqan.cn-hangzhou.fcapp.run, reactjs.org, retcode-sg-lazada.arms.aliyuncs.com, retcode-us-west-1.arms.aliyuncs.com, time.akamai.com, vuejs.org, www.ietf.org, www.w3.org, www.webrtc.org

Source & flagged code

6 flagged

dist/index.es.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.es.jsView on unpkg

114patternName = generic_password severity = medium line = 114 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.es.jsView on unpkg · L114

dist/index.umd.vue.jsView file

•Browser cookie sent to a fixed external endpoint in dist/index.umd.vue.js: `+c[u].replace(" at new "," at "),t.displayName&&a.includes("<anonymous>")&&(a=a.replace("<anonymous>",t.displayName)),"function"==typeof t&&k.set(t,a),a}while(1<=u&&0<=d);break}}}... Check the top-level render call using <`+t+">."),j[t=r])||(j[t]=!0,r="",e&&e._owner&&e._owner!==o.current&&(r=" It was passed a child from "+h(e._owner.type)+"."),g(e),m('Each chil... In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function ee(e){return"symbol"==typeof(e=((e,t)=>{if("object"!=typeof e||!e)return e;var r=e... `}},776:function(e,t,r){var n,i=this&&this.__extends||(n=function(e,t){return(n=Object.setPrototypeOf||({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.umd.vue.jsView on unpkg

107patternName = generic_password severity = medium line = 107 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Hardcoded password in dist/index.umd.vue.js

dist/index.umd.vue.jsView on unpkg · L107

dist/index.umd.jsView file

114patternName = generic_password severity = medium line = 114 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Hardcoded password in dist/index.umd.js

dist/index.umd.jsView on unpkg · L114

dist/index.es.vue.jsView file

107patternName = generic_password severity = medium line = 107 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Hardcoded password in dist/index.es.vue.js

dist/index.es.vue.jsView on unpkg · L107

Source & flagged code

6 flagged · loading source

dist/index.es.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.es.jsView on unpkg

114patternName = generic_password severity = medium line = 114 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.es.jsView on unpkg · L114

dist/index.umd.vue.jsView file

•Browser cookie sent to a fixed external endpoint in dist/index.umd.vue.js: `+c[u].replace(" at new "," at "),t.displayName&&a.includes("<anonymous>")&&(a=a.replace("<anonymous>",t.displayName)),"function"==typeof t&&k.set(t,a),a}while(1<=u&&0<=d);break}}}... Check the top-level render call using <`+t+">."),j[t=r])||(j[t]=!0,r="",e&&e._owner&&e._owner!==o.current&&(r=" It was passed a child from "+h(e._owner.type)+"."),g(e),m('Each chil... In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function ee(e){return"symbol"==typeof(e=((e,t)=>{if("object"!=typeof e||!e)return e;var r=e... `}},776:function(e,t,r){var n,i=this&&this.__extends||(n=function(e,t){return(n=Object.setPrototypeOf||({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.umd.vue.jsView on unpkg

107patternName = generic_password severity = medium line = 107 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Hardcoded password in dist/index.umd.vue.js

dist/index.umd.vue.jsView on unpkg · L107

dist/index.umd.jsView file

114patternName = generic_password severity = medium line = 114 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Hardcoded password in dist/index.umd.js

dist/index.umd.jsView on unpkg · L114

dist/index.es.vue.jsView file

107patternName = generic_password severity = medium line = 107 matchedText = `},l.par...+`\r

Medium

Secret Pattern

Hardcoded password in dist/index.es.vue.js

dist/index.es.vue.jsView on unpkg · L107

Findings

1 Critical1 High8 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.umd.vue.js

HighSemantic Analysis Limiteddist/index.es.js

MediumSecret Patterndist/index.es.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/index.umd.vue.js

MediumSecret Patterndist/index.umd.js

MediumSecret Patterndist/index.es.vue.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings