registry / @things-factory/integration-lmd / 10.1.231
@things-factory/integration-lmd@10.1.231
Module for managing last mile delivery partner integration
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source implements ordinary delivery integrations and shows no install-time or import-time attack. However, Citylink requests carry a stored Bearer token over plaintext HTTP to a fixed endpoint, creating a material credential exposure risk that warrants a warning.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A configured Citylink API action runs, such as from a workflow task; this does not run merely on package import or installation.
Impact
A network observer or intermediary could read the token and delivery data and potentially reuse the token.
Mechanism
The action passes the stored accessToken to a client that uses http://202.133.101.28:8889/CitylinkService.svc/rest and places the token in the Authorization header.
AI rationale
The source implements ordinary delivery integrations and shows no install-time or import-time attack. However, Citylink requests carry a stored Bearer token over plaintext HTTP to a fixed endpoint, creating a material credential exposure risk that warrants a warning.
Evidence
dist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/platform-action.jsdist-server/engine/task/lmd-api.jsdist-server/controllers/etrax/etrax.js
Network endpoints3
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorizeets.sntglobal.com
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The package identifies itself as a last-mile delivery integration.
- The Citylink client hard-codes an HTTP endpoint at 202.133.101.28:8889.
- Its platform action supplies a stored access token and account ID to the Citylink client, whose requests include the token as a Bearer credential.
- The client also defines an OAuth URL for Xero accounting scopes, making plaintext transport of credentials a material concern.
- The eTrax client sends delivery payloads to its configured partner endpoint as part of a POST request.
Evidence against
- There are no lifecycle scripts in package.json, and the package entry point mainly loads entities, migrations, GraphQL, middleware, controllers, and routes.
- The partner calls are made through registered delivery APIs and a workflow task, rather than on import or install.
- The flagged controller code maps delivery requests and partner responses; review found no unrelated collection or concealed behavior.
Behavioral surface
CryptoDynamicRequireNetwork
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.215
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.215
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
3 High6 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumAi Review Evidencepackage.json
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/platform-action.js
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
LowScripts Present
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.231.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Review the evidence and your use of @things-factory/integration-lmd@10.1.231 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.