@things-factory/integration-lmd@10.1.250
Module for managing last mile delivery partner integration
AI Security Review
scanned 12h ago · by lpm-firewall-aiThe Citylink adapter forwards a Xero bearer token to a hard-coded non-Xero endpoint over plain HTTP. That exposes an account credential to an unrelated host, so this version is malicious.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A configured workflow invokes a Citylink API action.
Impact
The recipient can obtain the Xero bearer token in transit and potentially use it to access the authorized Xero account.
Mechanism
The adapter reads accessToken and accountId from the last-mile record, then sends them to 202.133.101.28:8889; the token is also tied to a Xero authorization flow.
Attack narrative
When a configured Citylink action runs, the adapter sends the stored bearer access token and Xero tenant identifier to a hard-coded plain HTTP IP endpoint. The package’s authorization URL targets Xero and requests accounting scopes, so this exposes a Xero credential to a separate host without evidence of consent for that transfer.
AI rationale
The Citylink adapter forwards a Xero bearer token to a hard-coded non-Xero endpoint over plain HTTP. That exposes an account credential to an unrelated host, so this version is malicious.
Evidence
dist-server/controllers/citylink/citylink.jsdist-server/controllers/citylink/platform-action.js
Network endpoints2
202.133.101.28:8889/CitylinkService.svc/restlogin.xero.com/identity/connect/authorize
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Citylink requests go to a hard-coded plain HTTP endpoint at 202.133.101.28:8889.
- The adapter takes accessToken and accountId from a stored last-mile record and supplies them to the Citylink client.
- Requests send that access token as a Bearer credential and accountId as xero-tenant-id to the hard-coded endpoint.
- The adapter builds its authorization URL on login.xero.com with accounting scopes, indicating the access token is for Xero.
Evidence against
- The manifest describes a last-mile delivery integration package and declares no install or postinstall hook.
- The Citylink request is invoked through an API action used by a configured last-mile workflow, rather than running on import.
Behavioral surface
CryptoDynamicRequireNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist-server/migrations/index.jsView file
3exports.migrations = void 0;
L4: const glob = require('glob');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-server/migrations/index.jsView on unpkg · L3dist-server/controllers/citylink/platform-action.jsView file
•matchType = normalized_sha256
matchedPackage = @things-factory/integration-lmd@10.1.245
matchedPath = dist-[redacted]-action.js
matchedIdentity = npm:[redacted]:10.1.245
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/controllers/citylink/platform-action.jsView on unpkgFindings
6 High3 Medium3 Low
HighKnown Malware Source Similaritydist-server/controllers/citylink/platform-action.js
HighKnown Malware Source Similaritydist-server/controllers/etrax/platform-action.js
HighKnown Malware Source Fingerprint Signaturedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
HighAi Review Evidencedist-server/controllers/citylink/platform-action.js
HighAi Review Evidencedist-server/controllers/citylink/citylink.js
MediumDynamic Requiredist-server/migrations/index.js
MediumNetwork
MediumStripped Provenance Metadatadist-server/controllers/citylink/citylink.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @things-factory/integration-lmd@10.1.250.
See all versions of @things-factory/integration-lmd for other recorded verdicts.
- Avoid installing @things-factory/integration-lmd@10.1.250. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.