registry / @alipay/ams-checkout / 2.0.30
@alipay/ams-checkout@2.0.30
Use _AMS CHECKOUT_ as an ES module.
AI Security Review
scanned 16d ago · by lpm-firewall-aiInspected source supports ordinary checkout SDK requests and Alipay logging, while the flagged IP is part of serialized example configuration. No concrete malicious behavior was established, so mark clean.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing or using the checkout SDK activates its normal runtime code; the prepare hook runs Husky setup.
Impact
No malicious impact was established from the inspected source.
Mechanism
The package routes requests through its SDK request service and sends logs to Alipay collection endpoints. The inspected source did not show credentials being harvested or sent to an unrelated recipient.
AI rationale
Inspected source supports ordinary checkout SDK requests and Alipay logging, while the flagged IP is part of serialized example configuration. No concrete malicious behavior was established, so mark clean.
Evidence
package.jsonesm/index.jsesm/core/component/index.jsams-checkout.jsesm/modern/index.jsesm/modern/tools.jsesm/foundation/service/api-bus/ability/request.jsesm/foundation/service/api-bus/busManager.jsesm/config/request.jsesm/util/get.jsesm/request/utils.jsesm/foundation/service/api-bus/interface.jsesm/foundation/service/log/index.jstypes.d.tstypes.untrimmed.d.ts
Network endpoints3
imdap-sea.alipay.com/loggw/dwcookieLogGet.doimgs-sea-global.alipay.com/mgw.htm100.88.104.107:8081/download
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes checkout entrypoints and its only lifecycle hook runs Husky setup.
- The flagged IP is embedded as a checkout example image URL; runtime logging uses Alipay collection endpoints, and API-bus requests forward supplied request data through the request service.
- The inspected runtime and type-definition paths contain SDK exports, request utilities, API-bus interfaces, and declarations; no credential harvesting or unrelated credential recipient was identified.
Evidence against
- The scanner flagged a hardcoded runtime exfiltration pattern, dynamic require, and network behavior; inspection found the IP in serialized example configuration and the network code in SDK logging/request flows.
Behavioral surface
DynamicRequireEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
4 flaggedams-checkout.jsView file
5*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
ams-checkout.jsView on unpkg · L55Trigger-reachable chain: manifest.exports -> ams-checkout.js
L5: */
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
ams-checkout.jsView on unpkg · L55*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Medium
Dynamic Require
Findings
2 Critical3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationams-checkout.js
CriticalTrigger Reachable Dangerous Capabilityams-checkout.js
MediumDynamic Requireams-checkout.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalams-checkout.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @alipay/ams-checkout@2.0.30.
See all versions of @alipay/ams-checkout for other recorded verdicts.
- Review the evidence and your use of @alipay/ams-checkout@2.0.30 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.