@things-factory/integration-lmd@10.1.233
Module for managing last mile delivery partner integration
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe Citylink client sends a Xero access token to a fixed, separate HTTP endpoint. This is credential exfiltration, so the package should be blocked.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller invokes the Citylink platform action.
Impact
The recipient can obtain the Xero access token, and plain HTTP also exposes it to interception in transit.
Mechanism
The action passes lastMile.accessToken to the client, which places it in an Authorization Bearer header on a request to http://202.133.101.28:8889/CitylinkService.svc/rest.
Attack narrative
When the Citylink action is invoked, it passes the stored access token into a client that sends it as a Bearer credential to a hard-coded plain HTTP IP endpoint. The authorization flow identifies the token as part of a Xero accounting integration, while the recipient is a separate service. This exposes the credential to that service and to interception in transit.
AI rationale
The Citylink client sends a Xero access token to a fixed, separate HTTP endpoint. This is credential exfiltration, so the package should be blocked.
Evidence
dist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/platform-action.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Citylink sends requests to the hard-coded plain HTTP endpoint http://202.133.101.28:8889/CitylinkService.svc/rest.
- Citylink attaches the configured accessToken as a Bearer credential to requests sent to that endpoint.
- The Citylink action obtains accessToken and tenantId from lastMile and passes them into the client.
- Citylink's authorization URL uses Xero's login service and requests accounting scopes.
Evidence against
- The package describes itself as a last-mile delivery integration module.
- The client sends requests when its platform action is invoked, rather than during installation.
- The package has no install lifecycle scripts.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.215
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.215
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
6 High3 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/platform-action.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.233.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Avoid installing @things-factory/integration-lmd@10.1.233. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.