registry / Credential exfiltration / miam-injector
miam-injector
This report shows the evidence for miam-injector@2.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has no install hook, but its runtime code actively captures and persists a password by tampering with a browser networking primitive. The aligned endpoint reduces third-party exfiltration evidence but does not remove the unconsented credential-capture behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Loading mealz-injector-chronodrive.js on a Chronodrive page.
Impact
Retailer credentials are retained in browser storage and transmitted through an alternate login flow.
Mechanism
XHR prototype credential interception and replay
Attack narrative
The Chronodrive bundle installs an XMLHttpRequest.send hook at runtime, extracts pwd_login from successful retailer login requests, and saves it under _miam/userPwd. Its basket flow reads that value and posts it with the user ID to Chronodrive's mobile login endpoint to obtain a token, then uses that token to alter the cart. This is concrete credential interception and replay despite the endpoint being retailer-aligned.
AI rationale
The package has no install hook, but its runtime code actively captures and persists a password by tampering with a browser networking primitive. The aligned endpoint reduces third-party exfiltration evidence but does not remove the unconsented credential-capture behavior.
Evidence
package.jsonmealz-injector-chronodrive.jsmealz-injector-chronodrive.js.maplocalStorage:_miam/userPwd
Network endpoints2
www.chronodrive.com/mobile/ws/loginwww.chronodrive.com/mobile/ws/SendCart
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- mealz-injector-chronodrive.js.map captures login-form password by replacing XMLHttpRequest.prototype.send.
- It persists the captured password in localStorage as _miam/userPwd.
- It automatically reuses that password in a POST to Chronodrive's mobile login endpoint.
- Chronodrive main invokes interceptUserPwd at runtime; no user command gates it.
Evidence against
- package.json has no npm lifecycle hooks.
- Observed credential POST target is chronodrive.com, not an unrelated host.
Behavioral surface
ChildProcessNetwork
HighEntropyStringsMinifiedUrlStrings
CopyleftLicense
Source & flagged code
1 flagged · loading sourcemealz-injector-chronodrive.jsView file
1!function(){"use strict";try{if("undefined"!=typeof document){var e=document.createElement("style");e.appendChild(document.createTextNode("body{overflow:hidden!important}@keyframes...
L2: var e=Object.defineProperty,t=(t,r,i)=>((t,r,i)=>r in t?e(t,r,{enumerable:!0,configurable:!0,writable:!0,value:i}):t[r]=i)(t,"symbol"!=typeof r?r+"":r,i);import{U as r,S as i,R as ...
L3: //# sourceMappingURL=mealz-injector-chronodrive.js.map
Critical
Builtin Api Tampering Exfiltration
Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.
mealz-injector-chronodrive.jsView on unpkg · L1Findings
1 Critical1 Medium4 Low
CriticalBuiltin Api Tampering Exfiltrationmealz-injector-chronodrive.js
MediumNetwork
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to miam-injector@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing miam-injector@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.