registry / @mp-consulting/homebridge-lg-thinq / 1.0.31

@mp-consulting/homebridge-lg-thinq@1.0.31

A Homebridge plugin for controlling/monitoring LG ThinQ devices via LG ThinQ platform.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 550 KB of source, external domains: common.lgthinq.com, emp-oauth.lgecloud.com, kic.lgthinq.com, route.lgthinq.com, www.amazontrust.com, www.tbs-x509.com, www.websecurity.digicert.com

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 8-48javascript

8const input = (question) => new Promise((resolve) => {

9 const rl = readline.createInterface(process.stdin, process.stdout);

10 rl.question(question, (answer) => resolve(answer));

11});

12const program = new Command();

13const options = {

14 country: 'US',

15 language: 'en-US',

16};

17program

18 .option('-c, --country <type>', 'Country code for account', options.country)

19 .on('option:country', (value) => options.country = value)

20 .option('-l, --language <type>', 'Language code for account', options.language)

21 .on('option:language', (value) => options.language = value);

22program

23 .command('login')

24 .description('Obtain refresh_token from LG account')

25 .argument('<username>', 'LG username')

26 .argument('<password>', 'LG password')

27 .action(async (username, password) => {

28 console.info('Start login: username =', username, ', password =', password, ', country =', options.country, ', language =', options.language);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli.jsView on unpkg · L28

29 const logger = makeLogger();

30 try {

31 const api = new API(options.country, options.language, logger);

32 const gateway = await api.gateway();

33 const auth = new Auth(gateway, logger);

34 const session = await auth.login(username, password);

35 console.info('Your refresh_token:', session.refreshToken);

36 }

37 catch (err) {

38 console.error(err);

39 }

40 process.exit(0);

41});

42program

43 .command('auth')

44 .description('Obtain refresh_token from account logged by Google Account, Apple ID')

45 .action(async () => {

46 const logger = makeLogger();

47 const api = new API(options.country, options.language, logger);

48 const gateway = await api.gateway();

dist/api/Auth.jsView file

Lines 8-48javascript

8import { Session } from './Session.js';

9/**

10 * Handles authentication with the LG ThinQ API.

11 * This class manages login, token refresh, and user session handling.

12 */

13export class Auth {

14 gateway;

15 logger;

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = console....ge);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli.jsView on unpkg · L28

dist/api/Auth.jsView file

28this.logger = logger; L29: this.lgeapi_url = `https://${this.gateway.country_code.toLowerCase()}.lgeapi.com/`; L30: } ... L56: }; L57: const preLoginResponse = await requestClient.post(this.gateway.login_base_url + 'preLogin', qs.stringify(preLoginData), { headers }); L58: const preLogin = preLoginResponse.data; ... L347: signature(message, secret) { L348: return crypto.createHmac('sha1', Buffer.from(secret)).update(message).digest('base64'); L349: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/api/Auth.jsView on unpkg · L28

Findings

2 Medium6 Low

MediumSecret Patterndist/cli.js

MediumNetwork

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/api/Auth.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 8-48javascript

8const input = (question) => new Promise((resolve) => {

9 const rl = readline.createInterface(process.stdin, process.stdout);

10 rl.question(question, (answer) => resolve(answer));

11});

12const program = new Command();

13const options = {

14 country: 'US',

15 language: 'en-US',

16};

17program

18 .option('-c, --country <type>', 'Country code for account', options.country)

19 .on('option:country', (value) => options.country = value)

20 .option('-l, --language <type>', 'Language code for account', options.language)

21 .on('option:language', (value) => options.language = value);

22program

23 .command('login')

24 .description('Obtain refresh_token from LG account')

25 .argument('<username>', 'LG username')

26 .argument('<password>', 'LG password')

27 .action(async (username, password) => {

28 console.info('Start login: username =', username, ', password =', password, ', country =', options.country, ', language =', options.language);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli.jsView on unpkg · L28

29 const logger = makeLogger();

30 try {

31 const api = new API(options.country, options.language, logger);

32 const gateway = await api.gateway();

33 const auth = new Auth(gateway, logger);

34 const session = await auth.login(username, password);

35 console.info('Your refresh_token:', session.refreshToken);

36 }

37 catch (err) {

38 console.error(err);

39 }

40 process.exit(0);

41});

42program

43 .command('auth')

44 .description('Obtain refresh_token from account logged by Google Account, Apple ID')

45 .action(async () => {

46 const logger = makeLogger();

47 const api = new API(options.country, options.language, logger);

48 const gateway = await api.gateway();

dist/api/Auth.jsView file

Lines 8-48javascript

8import { Session } from './Session.js';

9/**

10 * Handles authentication with the LG ThinQ API.

11 * This class manages login, token refresh, and user session handling.

12 */

13export class Auth {

14 gateway;

15 logger;