@things-factory/integration-lmd@10.1.244
Module for managing last mile delivery partner integration
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe Citylink client combines Xero OAuth scopes with requests that send a stored bearer token and tenant identifier to a fixed endpoint over HTTP. Since the token's service ownership is unclear and requests run only through a configured workflow, this is a real credential-handling risk but not enough to establish intentional exfiltration.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A configured integration workflow invokes a Citylink API action, such as creating a shipment.
Impact
If the stored token is an Xero token, the destination can receive it, and HTTP also exposes it to network interception. The source does not establish whether the token is instead a Citylink-specific credential.
Mechanism
The client obtains `lastMile.accessToken` and `lastMile.accountId`, then sends them as a bearer token and `xero-tenant-id` header to `http://202.133.101.28:8889/CitylinkService.svc/rest`. The same client builds an OAuth URL requesting Xero accounting scopes.
AI rationale
The Citylink client combines Xero OAuth scopes with requests that send a stored bearer token and tenant identifier to a fixed endpoint over HTTP. Since the token's service ownership is unclear and requests run only through a configured workflow, this is a real credential-handling risk but not enough to establish intentional exfiltration.
Evidence
dist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/platform-action.jsdist-server/controllers/lmd-api/decorators.jsdist-server/engine/task/lmd-api.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The Citylink client requests Xero OAuth scopes for email and accounting data.
- Citylink requests go to a hard-coded HTTP endpoint and include a bearer access token and `xero-tenant-id` header.
- The token comes from the configured last-mile record; the code does not show it being checked against the destination service.
- The shipment API is invoked through a configured integration workflow, rather than automatically at install or import.
Evidence against
- The package is a last-mile delivery integration, and its Citylink API sends shipment requests to a Citylink-named service.
- The outbound request is reached through an explicitly configured workflow action.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.241
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.241
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
3 High6 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/platform-action.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.244.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Review the evidence and your use of @things-factory/integration-lmd@10.1.244 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.