@things-factory/integration-lmd@10.1.245
Module for managing last mile delivery partner integration
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe source identifies the token flow as Xero OAuth, then sends that bearer token and tenant ID to a hard-coded Citylink host over unencrypted HTTP. This is a concrete transfer of service credentials to a different host without evidence of consent for that disclosure.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
When an application invokes the registered Citylink platform action.
Impact
The remote host can receive the Xero access token and tenant identifier, exposing access covered by the configured accounting scopes.
Mechanism
The action loads accessToken and accountId from the last-mile record, then sends them as a Bearer token and xero-tenant-id header to an HTTP endpoint at 202.133.101.28:8889.
Attack narrative
The Citylink client advertises Xero OAuth scopes, then the registered platform action supplies the saved access token and tenant ID to a client that sends them to a hard-coded Citylink endpoint over plain HTTP. This exposes Xero credentials to a remote host outside Xero when the action is invoked.
AI rationale
The source identifies the token flow as Xero OAuth, then sends that bearer token and tenant ID to a hard-coded Citylink host over unencrypted HTTP. This is a concrete transfer of service credentials to a different host without evidence of consent for that disclosure.
Evidence
dist-server/controllers/citylink/platform-action.jsdist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/index.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- Citylink builds an OAuth authorization URL for Xero with accounting scopes.
- The Citylink action takes accessToken and accountId from a LastMileDelivery record and passes them to the client.
- The client sends the bearer token and Xero tenant ID to the hard-coded Citylink endpoint over HTTP.
- The Citylink action is registered as a platform operation and forwards requests through that client.
Evidence against
- The package describes itself as a last-mile delivery partner integration, and the endpoint is named CitylinkService.
- The transfer occurs when the Citylink platform action is invoked; the reviewed manifest has no install lifecycle scripts.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.241
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.241
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
6 High3 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/index.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.245.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Avoid installing @things-factory/integration-lmd@10.1.245. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.