@alipay/ams-checkout@2.0.32
Use _AMS CHECKOUT_ as an ES module.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source shows default runtime telemetry that includes merchant and payment-session identifiers and sends it to a fixed vendor endpoint. This is suspicious telemetry, but the endpoint and behavior are consistent with the checkout SDK’s diagnostics; no credential theft or unrelated collection was identified.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Creating an SDK instance initializes the tracker by default.
Impact
Merchant and payment-session identifiers are disclosed to the telemetry service during SDK use.
Mechanism
The SDK loads a tracker script from an Alipay CDN and configures it to report events to an Alipay endpoint; logging metadata includes merchant and payment-session identifiers.
AI rationale
The source shows default runtime telemetry that includes merchant and payment-session identifiers and sends it to a fixed vendor endpoint. This is suspicious telemetry, but the endpoint and behavior are consistent with the checkout SDK’s diagnostics; no credential theft or unrelated collection was identified.
Evidence
esm/core/instance/index.jsesm/foundation/service/log/index.jsesm/util/logger.js
Network endpoints2
gw-intl.alipayobjects.com/render/p/yuyan_npm/@alipay_intl-tracker/1.6.0/dist/common.min.jsimdap-sea.alipay.com/loggw/dwcookieLogGet.do
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Constructing an SDK instance initializes the tracker and sends an initial SDK event.
- Runtime telemetry includes the merchant ID and payment session ID.
- The tracker is configured to load from an Alipay CDN and send to an Alipay logging endpoint.
Evidence against
- The telemetry endpoints belong to Alipay, consistent with the checkout SDK’s purpose.
- The prepare script only runs Husky installation.
Behavioral surface
DynamicRequireEvalNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggedams-checkout.jsView file
5*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
ams-checkout.jsView on unpkg · L55Trigger-reachable chain: manifest.exports -> ams-checkout.js
L5: */
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
ams-checkout.jsView on unpkg · L55*/
L6: !function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var r in n)("ob...
Medium
Dynamic Require
Findings
2 Critical3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationams-checkout.js
CriticalTrigger Reachable Dangerous Capabilityams-checkout.js
MediumDynamic Requireams-checkout.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalams-checkout.js
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @alipay/ams-checkout@2.0.32.
See all versions of @alipay/ams-checkout for other recorded verdicts.
- Review the evidence and your use of @alipay/ams-checkout@2.0.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.