@things-factory/integration-lmd@10.1.218
Module for managing last mile delivery partner integration
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found no install hook or independent attack behavior. The Citylink code forwards stored Xero credentials to a fixed endpoint whose relationship to the intended service cannot be established from the package, warranting a warning.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller invokes the Citylink platform action for a delivery request.
Impact
If the endpoint is not an intended gateway, it receives a stored Xero token and tenant identifier; the inspected source does not show further use of them.
Mechanism
The action passes stored access credentials to the Citylink client, whose request methods attach them to requests at a hardcoded endpoint.
AI rationale
Source inspection found no install hook or independent attack behavior. The Citylink code forwards stored Xero credentials to a fixed endpoint whose relationship to the intended service cannot be established from the package, warranting a warning.
Evidence
dist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/platform-action.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest declares the server entry point and build or migration scripts; it has no install lifecycle hook.
- The flagged GraphQL files define last-mile delivery and courier-service types and inputs.
- The reviewed framework and utility dependency paths resolve to ordinary exports, browser setup, Node or browser selection, and HTTP client code.
- The Citylink client builds a Xero authorization URL with accounting scopes, then sends a bearer access token and tenant ID to a fixed HTTP endpoint; the platform action passes it stored credentials for request methods.
- The Etrax client posts delivery data with a generated partner token to its configured endpoint.
- The source does not establish whether the fixed Citylink endpoint is an intended gateway or an unrelated recipient.
Evidence against
- No install-time execution, secret harvesting, or independent malicious behavior was identified in the reviewed files.
- The package is a delivery-partner integration, and the reviewed Citylink transfer may be part of its intended service flow; recipient safety remains unresolved.
Behavioral surface
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.215
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.215
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
3 High6 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist-server/graphql/types/last-mile-delivery/new-last-mile-delivery.js
MediumAi Review Evidencedist-server/graphql/types/last-mile-delivery/last-mile-delivery-patch.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.218.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Review the evidence and your use of @things-factory/integration-lmd@10.1.218 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.