registry / @alipay/ams-checkout / 2.0.29
@alipay/ams-checkout@2.0.29
Use _AMS CHECKOUT_ as an ES module.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found ordinary package entrypoints and a prepare-only Husky command. The runtime tracker loader alone is package-aligned browser telemetry, not concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer imports and uses the checkout SDK in a browser context.
Impact
This supports checkout telemetry functionality; inspected source did not establish malicious execution, credential exfiltration, persistence, or install-time project mutation.
Mechanism
The bundle inserts a script for a fixed Marmot Cloud tracker URL; package metadata exposes local ESM and CommonJS entrypoints.
AI rationale
Static inspection found ordinary package entrypoints and a prepare-only Husky command. The runtime tracker loader alone is package-aligned browser telemetry, not concrete malicious behavior.
Network endpoints1
cdn.marmot-cloud.com/tnpm-package/@antintl-intl-tracker/1.3.0/dist/common.min.js
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Package metadata maps the public ESM and CommonJS entrypoints to local checkout bundles.
- The only lifecycle-like script inspected is a prepare-time Husky setup command.
- The required bundle contains a fixed browser tracker-script loader for a named Marmot Cloud asset.
Evidence against
- The bundle dynamically loads a remote tracker asset at browser runtime, but the inspected code ties it to checkout telemetry and shows no concrete credential harvesting, local execution, or unconsented install-time mutation.
Behavioral surface
DynamicRequireEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggedams-checkout.jsView file
5*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
ams-checkout.jsView on unpkg · L55Trigger-reachable chain: manifest.exports -> ams-checkout.js
L5: */
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
ams-checkout.jsView on unpkg · L55*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Medium
Dynamic Require
Findings
2 Critical3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationams-checkout.js
CriticalTrigger Reachable Dangerous Capabilityams-checkout.js
MediumDynamic Requireams-checkout.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalams-checkout.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @alipay/ams-checkout@2.0.29.
See all versions of @alipay/ams-checkout for other recorded verdicts.
- Review the evidence and your use of @alipay/ams-checkout@2.0.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.