registry / @pisell/private-materials / 3.4.136

@pisell/private-materials@3.4.136

pisell前端使用的私有物料

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Runtime payment flows transmit payment and diagnostic data to hardcoded third-party Feishu webhooks. This is an unconsented data-exfiltration path, not required for package installation.

Static reason

No blocking static signals were detected.

Trigger

Consumer renders or uses payment/EFTPOS components, including payment initialization or error handling.

Impact

Payment-group data, order/device identifiers, transaction logs, and error stacks may be disclosed to webhook recipients.

Mechanism

Hardcoded webhook POSTs through sendWarningLog

Attack narrative

The bundled low-code runtime defines sendWarningLog with embedded Feishu webhook URLs and POSTs supplied title/content. Payment components invoke it on initialization and failures, including serialized payGroup data, transaction/order/device identifiers, payment logs, and error stacks. These runtime disclosures occur without a consumer-configured telemetry endpoint or consent mechanism.

Rationale

Source inspection confirms concrete payment-related data exfiltration to hardcoded external webhook credentials. Lack of lifecycle hooks does not mitigate the runtime disclosure path.

Evidence

package.jsonbuild/lowcode/view.jslib/components/pay/toC/PaymentMethods/index.jslib/components/eftposPay/utils/payLog.jses/hooks/usePaymentLogger.js

Network endpoints2

open.feishu.cn/open-apis/bot/v2/hook/985186a7-d939-4daf-9f30-3a3cc9c47d97

@pisell/private-materials@3.4.136

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code