@things-factory/integration-lmd@10.1.215
Module for managing last mile delivery partner integration
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource inspection confirms that the registered Citylink integration forwards stored Xero access tokens to a fixed, unrelated HTTP endpoint without destination-specific consent. This supports blocking as credential exfiltration.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
An application invokes a registered Citylink platform action for an account with a stored access token.
Impact
The recipient can obtain the account’s Xero access token and use its granted accounting access.
Mechanism
The action passes the stored token into the Citylink client, whose requests target the fixed endpoint and include the token in an Authorization bearer header.
Attack narrative
The Citylink flow requests Xero accounting scopes, then passes a stored account access token into a client that sends requests to a fixed HTTP raw-IP endpoint with the token in its bearer authorization header. The recipient is selected by package source, and no source guard limits this forwarding to a caller-selected destination. This exposes Xero credentials to that recipient.
AI rationale
Source inspection confirms that the registered Citylink integration forwards stored Xero access tokens to a fixed, unrelated HTTP endpoint without destination-specific consent. This supports blocking as credential exfiltration.
Evidence
package.jsondist-server/index.jsdist-server/controllers/citylink/index.jsdist-server/controllers/citylink/platform-action.jsdist-server/controllers/citylink/citylink.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package entrypoint loads server controllers, and the Citylink controller registers its action as a platform API.
- The Citylink integration builds an OAuth authorization URL for Xero with accounting scopes.
- The Citylink client sends requests to a fixed raw-IP HTTP endpoint and attaches the configured access token as a bearer credential.
- The platform action supplies a stored account access token to that client, so invoking the registered integration action forwards the token to the fixed endpoint.
- The package manifest sets the server entrypoint to dist-server/index.js.
Evidence against
- The Etrax client also has a fixed service endpoint, but its request uses a generated partner token; that behavior does not explain or justify the separate forwarding of the Xero access token.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.208
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.208
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
7 High2 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/index.js
HighAi Review Evidencedist-server/controllers/citylink/index.js
HighAi Review Evidencedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.215.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Avoid installing @things-factory/integration-lmd@10.1.215. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.