registry / @alipay/ams-checkout / 2.0.31
@alipay/ams-checkout@2.0.31
⚠ Under reviewUse _AMS CHECKOUT_ as an ES module.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe flagged collector code is consistent with SDK logging through host iTracker and region-specific Antom endpoints, with no verified credential theft. The unresolved imported runtime dependency prevents a clean verdict because its behavior could not be assessed.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing the SDK can load its modern preload adapter and runtime dependency.
Impact
The dependency's behavior and any resulting effects remain unresolved.
Mechanism
The adapter imports a package declared as a runtime dependency, but that dependency's source was unavailable for inspection.
AI rationale
The flagged collector code is consistent with SDK logging through host iTracker and region-specific Antom endpoints, with no verified credential theft. The unresolved imported runtime dependency prevents a clean verdict because its behavior could not be assessed.
Evidence
package.jsonesm/modern/preload/antomManifestAdapter.js
Decision evidence
public snapshotAI called this Manual Review at 72.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest declares @antintl/opensdk-preload as a runtime dependency, and the preload adapter imports it; its source was unavailable in the supplied snapshot.
- The SDK logging service reports queued events through the host page's iTracker interface, and the modern bundle contains region-specific Antom logging endpoints.
Evidence against
- The inspected source does not establish that the unresolved preload dependency performs malicious behavior or that the logging path sends credentials to an unrelated recipient.
Behavioral surface
DynamicRequireEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggedams-checkout.jsView file
5*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
ams-checkout.jsView on unpkg · L55Trigger-reachable chain: manifest.exports -> ams-checkout.js
L5: */
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
ams-checkout.jsView on unpkg · L55*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Medium
Dynamic Require
Findings
2 Critical3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationams-checkout.js
CriticalTrigger Reachable Dangerous Capabilityams-checkout.js
MediumDynamic Requireams-checkout.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalams-checkout.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @alipay/ams-checkout@2.0.31.
See all versions of @alipay/ams-checkout for other recorded verdicts.
- Review the evidence and your use of @alipay/ams-checkout@2.0.31 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.