@things-factory/integration-lmd@10.1.208
Module for managing last mile delivery partner integration
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected source traces a saved access token from the delivery record into an Authorization header sent to a fixed endpoint, while identifying Xero as the authorization service. This is concrete credential exposure and supports blocking the package.
Static reason
No blocking static signals were detected.
Trigger
A caller invokes the registered Citylink shipment request action.
Impact
The saved service credential is disclosed to the fixed recipient, creating a risk of unauthorized access to the associated account.
Mechanism
The action supplies the saved access token and tenant ID to a client that sends a POST with the token in its Authorization header to a fixed endpoint.
Attack narrative
The Citylink shipment action passes a saved access token into a client that posts it to a fixed service endpoint. The same client builds authorization URLs for Xero, while the credential transfer has no recipient-specific consent or destination binding in the inspected source. This exposes the saved service credential when the shipment action runs.
AI rationale
The inspected source traces a saved access token from the delivery record into an Authorization header sent to a fixed endpoint, while identifying Xero as the authorization service. This is concrete credential exposure and supports blocking the package.
Evidence
dist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/platform-action.jsdist-server/controllers/citylink/apis/shipment-request/create-shipment-request.jsdist-server/controllers/citylink/index.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The client creates Xero authorization URLs, but sends requests to a fixed Citylink service endpoint.
- The Citylink action takes the saved delivery record's access token and tenant ID.
- A shipment request is registered as a POST action and dispatched through that client.
- The POST sends the saved access token as a bearer credential to the fixed endpoint.
Evidence against
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/citylink.jsView file
47const endpoint = `${ENDPOINT}${path}`;
debug('endpoint', endpoint);
const response = await (0, node_fetch_1.default)(endpoint, {
method: 'post',
headers: {
accept: 'application/json',
High
Ai Review Evidence
The POST sends the saved access token as a bearer credential to the fixed endpoint.
dist-server/controllers/citylink/citylink.jsView on unpkg · L47Findings
5 High4 Medium3 Low
HighAi Review Evidencedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/apis/shipment-request/create-shipment-request.js
HighAi Review Evidencedist-server/controllers/citylink/index.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.208.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Avoid installing @things-factory/integration-lmd@10.1.208. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.