registry / @alipay/ams-checkout / 2.0.27
@alipay/ams-checkout@2.0.27
Use _AMS CHECKOUT_ as an ES module.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic findings reflect normal browser checkout networking and a generic loader, but source inspection found no concrete malicious behavior. The prepare hook is a VCS-hook setup command rather than an install-time attack chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A host application invokes checkout or logging functionality.
Impact
No package-originated credential theft, install-time mutation, or persistence was found.
Mechanism
Configured browser requests and payment-related script loading.
AI rationale
Static findings reflect normal browser checkout networking and a generic loader, but source inspection found no concrete malicious behavior. The prepare hook is a VCS-hook setup command rather than an install-time attack chain.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The browser bundle contains a generic remote script loader.
- The manifest has a prepare hook that invokes Husky.
Evidence against
- The only lifecycle hook is prepare, not an automatic registry install hook, and it only runs Husky.
- Payment requests are made after the SDK request method is called and target configured checkout endpoints.
- The flagged data consists of browser and request context used by checkout, not local files, environment secrets, or credentials.
- No self-dependency, shell execution, persistence, destructive action, or AI-agent configuration mutation was found.
Behavioral surface
ChildProcessDynamicRequireEvalNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggedams-checkout.jsView file
5*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Low
Eval
Package source references a known benign dynamic code generation pattern.
ams-checkout.jsView on unpkg · L5esm/util/logger.jsView file
200// @ts-expect-error amd
L201: window.require([moduleId], callback, function (err) {
L202: console.error('AMD load failed, falling back to script tag', err);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
esm/util/logger.jsView on unpkg · L200esm/modern/tools.jsView file
Findings
2 Critical3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationesm/modern/tools.js
CriticalTrigger Reachable Dangerous Capabilityesm/modern/tools.js
MediumDynamic Requireesm/util/logger.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalams-checkout.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @alipay/ams-checkout@2.0.27.
See all versions of @alipay/ams-checkout for other recorded verdicts.
- Review the evidence and your use of @alipay/ams-checkout@2.0.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.