@things-factory/integration-lmd@10.1.238
Module for managing last mile delivery partner integration
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe Citylink integration forwards a Xero bearer token and tenant ID to a hard-coded plain-HTTP IP endpoint unrelated to Xero. That credential disclosure is a concrete exfiltration risk.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller invokes a Citylink platform API action, such as a delivery operation.
Impact
The endpoint operator or an on-path observer can obtain the Xero bearer token and tenant context, potentially enabling access within the token’s granted accounting scopes.
Mechanism
The action passes the saved access token and account ID to a client that sends them in the Authorization and xero-tenant-id headers to a hard-coded IP endpoint.
Attack narrative
When a Citylink API action is called, the package forwards the saved Xero access token and tenant ID to 202.133.101.28 over plain HTTP. The client also constructs a Xero authorization URL requesting accounting scopes. This exposes a credential for Xero to a hard-coded non-Xero endpoint, where it can be captured by the endpoint operator or an on-path observer.
AI rationale
The Citylink integration forwards a Xero bearer token and tenant ID to a hard-coded plain-HTTP IP endpoint unrelated to Xero. That credential disclosure is a concrete exfiltration risk.
Evidence
dist-server/controllers/citylink/platform-action.jsdist-server/controllers/citylink/citylink.js
Network endpoints1
202.133.101.28:8889/CitylinkService.svc/rest
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The Citylink client sends requests to the hard-coded plain-HTTP endpoint http://202.133.101.28:8889/CitylinkService.svc/rest.
- The Citylink action copies the saved last-mile access token and account ID into the client configuration.
- The client sends that token as a Bearer credential and the account ID as the xero-tenant-id header.
- The client’s authorization URL requests Xero accounting scopes, identifying the forwarded token as a Xero credential.
Evidence against
- The package describes itself as a last-mile delivery integration module.
- The credential forwarding occurs through the Citylink API action path, not an install hook or import-time request.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.236
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.236
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
6 High3 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.238.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Avoid installing @things-factory/integration-lmd@10.1.238. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.