@alipay/ams-checkout
Use _AMS CHECKOUT_ as an ES module.
This report shows the evidence for @alipay/ams-checkout@2.0.32. 0 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe source shows default runtime telemetry that includes merchant and payment-session identifiers and sends it to a fixed vendor endpoint. This is suspicious telemetry, but the endpoint and behavior are consistent with the checkout SDK’s diagnostics; no credential theft or unrelated collection was identified.
Decision evidence
public snapshot- Constructing an SDK instance initializes the tracker and sends an initial SDK event.
- Runtime telemetry includes the merchant ID and payment session ID.
- The tracker is configured to load from an Alipay CDN and send to an Alipay logging endpoint.
- The telemetry endpoints belong to Alipay, consistent with the checkout SDK’s purpose.
- The prepare script only runs Husky installation.
Source & flagged code
4 flaggedSource sends credentials or rich application records to a package-controlled external receiver enabled by default.
ams-checkout.jsView on unpkg · L5A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
ams-checkout.jsView on unpkg · L5Findings
Affected versions and remediation
This report applies to @alipay/ams-checkout@2.0.32.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @alipay/ams-checkout@2.0.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.