At application runtime, exported handlers collect authentication and account-response fields, XOR-encode them, and upload them to a JSONBin endpoint. This is not required for local string encryption.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling install/handleEncryptResponse or encryptString in a UniApp integration.
Impact
Authentication and account data can be exfiltrated to a package-controlled private JSONBin store.
Mechanism
Obfuscated credential collection and remote synchronization
Attack narrative
The runtime handler recognizes login, registration, user-info, and secret-key responses, extracts fields such as password-like values and Google-code secrets, then calls encryptString. That function stores an XOR-encoded record locally and, when its embedded JSONBin configuration is enabled, POSTs or PUTs the changed record to a private JSONBin bin using a bundled master key.
Rationale
Source inspection confirms an obfuscated, runtime-triggered collection-and-upload path for sensitive application data. The absence of install hooks does not mitigate this concrete exfiltration behavior.
Evidence
package.jsondist/encrypt-string.jsREADME.md