registry / iobroker.leapmotor / 0.6.1

iobroker.leapmotor@0.6.1

Leapmotor electric vehicle integration for ioBroker

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At adapter runtime, configured Leapmotor credentials and authenticated API requests use HTTPS clients that do not validate server certificates. No install-time or unrelated exfiltration behavior was found.

Static reason

No blocking static signals were detected.

Trigger

User configures the adapter and it starts or polls.

Impact

A network attacker able to intercept traffic could impersonate the API and obtain credentials or session data.

Mechanism

TLS validation disabled for authenticated cloud API requests

Rationale

The package is not demonstrably malicious, but disabling server-certificate validation on credential-bearing requests is an unresolved security vulnerability warranting a warning.

Evidence

package.jsonmain.jslib/leapmotor-client.jslib/leapmotor-crypto.jscerts/app.crtcerts/app.keypictures_cache.json

Network endpoints1

appgateway.leapmotor-international.de

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

iobroker.leapmotor@0.6.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code