@things-factory/integration-lmd@10.1.241
Module for managing last mile delivery partner integration
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe Citylink adapter forwards a Xero bearer token to a hard-coded external IP over unencrypted HTTP. This exposes a credential to a host outside the service it authenticates with and warrants blocking.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller invokes a Citylink API action, such as creating a shipment request.
Impact
The endpoint can receive the Xero bearer token and tenant identifier outside Xero, exposing the account credential to the remote service and network observers.
Mechanism
The adapter passes the stored Xero access token and tenant ID to requests sent to a hard-coded IP endpoint using unencrypted HTTP.
Attack narrative
When a Citylink API action runs, the adapter forwards the stored Xero access token and tenant ID to a fixed HTTP endpoint at 202.133.101.28. This sends a credential belonging to Xero to a separate service without a user-configurable endpoint or explicit credential-sharing consent.
AI rationale
The Citylink adapter forwards a Xero bearer token to a hard-coded external IP over unencrypted HTTP. This exposes a credential to a host outside the service it authenticates with and warrants blocking.
Evidence
dist-server/controllers/citylink/platform-action.jsdist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/apis/shipment-request/create-shipment-request.js
Network endpoints1
202.133.101.28:8889/CitylinkService.svc/rest
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- Citylink sends requests to the hard-coded HTTP endpoint http://202.133.101.28:8889/CitylinkService.svc/rest.
- Citylink requests include the Xero bearer access token and tenant ID in their headers.
- The adapter supplies lastMile.accessToken as that bearer token.
- The Citylink shipment-request API registers a POST to /requestShipment.
Evidence against
- The package describes itself as a last-mile delivery partner integration, and the shipment request is an ordinary integration operation.
- The flagged controller files contain readable adapter code rather than concealed behavior.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.238
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.238
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
7 High2 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/apis/shipment-request/create-shipment-request.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
LowScripts Present
Low
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.241.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Avoid installing @things-factory/integration-lmd@10.1.241. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.