@things-factory/integration-lmd@10.1.206
Module for managing last mile delivery partner integration
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe Xero token is forwarded to a fixed Citylink service endpoint, and the inspected code does not establish recipient-specific consent. Because the transfer is tied to an API operation and the source leaves the recipient relationship unresolved, this warrants a warning rather than a block.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes a Citylink API operation, such as creating a shipment.
Impact
The service and network observers may receive the Xero credential; the inspected source does not establish recipient-specific authorization for this transfer.
Mechanism
The platform action passes the stored token to the adapter, which adds it to requests sent to the fixed service address.
AI rationale
The Xero token is forwarded to a fixed Citylink service endpoint, and the inspected code does not establish recipient-specific consent. Because the transfer is tied to an API operation and the source leaves the recipient relationship unresolved, this warrants a warning rather than a block.
Evidence
dist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/platform-action.jsdist-server/controllers/citylink/apis/shipment-request/create-shipment-request.jsdist-server/controllers/lmd-api/decorators.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The adapter builds an authorization URL for Xero with accounting access, identifying the stored credential as an Xero access token.
- Citylink API requests send the stored bearer token and tenant identifier to a fixed HTTP service address.
- The platform action supplies the stored token to the adapter; shipment creation invokes that action with a POST request.
- The token transfer is tied to a registered API operation, leaving the recipient’s authorization to receive the Xero credential unresolved.
Evidence against
- The inspected transfer path is part of the Citylink shipment API flow; it does not show install-time or background transmission.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/citylink.jsView file
17https://login.xero.com/identity/connect/authorize?response_type=code&client_id=${apiKey}&scope=${scopes}&redirect_uri=${redirectUrl}&state=${nonce}`;
}
async
Medium
Stripped Provenance Metadata
The adapter builds an authorization URL for Xero with accounting access, identifying the stored credential as an Xero access token.
dist-server/controllers/citylink/citylink.jsView on unpkg · L17Findings
9 Medium3 Low
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/platform-action.js
MediumAi Review Evidencedist-server/controllers/lmd-api/decorators.js
MediumAi Review Evidencedist-server/controllers/citylink/apis/shipment-request/create-shipment-request.js
LowScripts Present
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.206.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Review the evidence and your use of @things-factory/integration-lmd@10.1.206 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.