@oxy.so/api@1.0.1
Not a published library: the Oxy API server was published by mistake. Do not install.
OxyHQ API server with authentication, user management, and real-time features
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe server automatically sends an Oxy service token to a different service host during incoming email processing. This is credential exfiltration under the package review rules, even though the accompanying event contains metadata rather than message content.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An email is received and stored by the API server.
Impact
The external Alia host receives a credential for the Oxy service and identifiers and routing metadata for incoming messages.
Mechanism
The inbox handler obtains a service token from the Oxy-configured client and uses it as a Bearer token in a POST to ALIA_API_URL, defaulting to https://api.alia.onl.
Attack narrative
When the API stores an incoming email, it automatically invokes the inbox event publisher. That publisher obtains a service token from an Oxy API client and forwards it as a Bearer credential to https://api.alia.onl/webhooks/oxy by default, along with mailbox event metadata. The credential crosses to a different service host without a user-run action or consent gate.
AI rationale
The server automatically sends an Oxy service token to a different service host during incoming email processing. This is credential exfiltration under the package review rules, even though the accompanying event contains metadata rather than message content.
Evidence
src/capabilities/inbox-service-client.tssrc/capabilities/inbox.events.tssrc/services/email.service.ts
Network endpoints1
api.alia.onl/webhooks/oxy
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Inbox service credentials configure an Oxy API client, which obtains a service token.
- When an email is received, the server automatically publishes its account and message metadata through the inbox event handler.
- The handler sends the Oxy service token as a Bearer credential to the default host https://api.alia.onl.
Evidence against
- The registration script is an explicit npm command, not an install hook.
- The event payload contains message identifiers and routing metadata, not message content.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggedjest.setup.cjsView file
1// Jest setup for API package
L2: const dotenv = require('dotenv');
L3: dotenv.config({ path: '.env.test' });
Medium
Dynamic Require
Package source references dynamic require/import behavior.
jest.setup.cjsView on unpkg · L1src/services/senderAvatar.service.tsView file
1import crypto from 'crypto';
L2: import dns from 'dns/promises';
L3: import net from 'net';
...
L13: const BLOCKED_HOSTNAMES = new Set(['localhost', 'localhost.localdomain']);
L14: const PRIVATE_IPV4_RANGES: Array<[number, number]> = [
L15: [0x00000000, 0xff000000], // 0.0.0.0/8
...
L28:
L29: /** Build a base64-encoded proxy path for an external URL. */
L30: function proxyPath(url: string): string {
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/services/senderAvatar.service.tsView on unpkg · L1scripts/register-inbox-capability-catalog.tsView file
Findings
1 Critical2 High5 Medium7 Low
CriticalPrevious Version Dangerous Deltasrc/db/testDatabase.ts
HighCredential Exfiltrationscripts/register-inbox-capability-catalog.ts
HighSemantic Analysis Limitedscripts/generate-updates-code-signing.ts
MediumDynamic Requirejest.setup.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/run-native-product-agent-bootstrap.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptosrc/services/senderAvatar.service.ts
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @oxy.so/api@1.0.1.
See all versions of @oxy.so/api for other recorded verdicts.
- Avoid installing @oxy.so/api@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.