registry / @things-factory/integration-lmd / 10.1.247
@things-factory/integration-lmd@10.1.247
Module for managing last mile delivery partner integration
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe code uses Xero OAuth scopes but sends the stored token to a hard-coded Citylink endpoint over unencrypted HTTP. This appears tied to an invoked delivery integration request, so the source does not establish malicious collection, but the credential exposure risk merits a warning.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller invokes a registered Citylink API action.
Impact
Because the connection is unencrypted and the token is associated with Xero OAuth scopes, network observers could capture it; the source does not establish that the endpoint is malicious.
Mechanism
The action passes the stored access token to a client that sends it in a Bearer header to a hard-coded HTTP endpoint.
AI rationale
The code uses Xero OAuth scopes but sends the stored token to a hard-coded Citylink endpoint over unencrypted HTTP. This appears tied to an invoked delivery integration request, so the source does not establish malicious collection, but the credential exposure risk merits a warning.
Evidence
dist-server/controllers/citylink/platform-action.jsdist-server/controllers/citylink/citylink.js
Network endpoints2
login.xero.com/identity/connect/authorize202.133.101.28:8889/CitylinkService.svc/rest
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The Citylink client builds an OAuth authorization URL on Xero and requests accounting scopes.
- The Citylink action passes the stored access token and tenant ID to its client when dispatching an API request.
- The Citylink client sends requests to a fixed endpoint using plain HTTP.
- Requests to that endpoint include the stored token as a Bearer authorization header.
Evidence against
- The package describes itself as a last-mile delivery integration, and its Citylink code dispatches API requests as part of that feature.
- The manifest has no install lifecycle scripts, and the reviewed entry point registers routes rather than sending requests at import time.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.245
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.245
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
3 High6 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
MediumAi Review Evidencedist-server/controllers/citylink/platform-action.js
MediumAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.247.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Review the evidence and your use of @things-factory/integration-lmd@10.1.247 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.