registry / miam-injector / 2.0.0

miam-injector@2.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

When the Chronodrive injector runs in a browser, it hooks all XHR sends to capture a retailer login password. It stores and reuses that password to obtain a mobile API token.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading mealz-injector-chronodrive.js on a Chronodrive page.

Impact

Retailer credentials are retained in browser storage and transmitted through an alternate login flow.

Mechanism

XHR prototype credential interception and replay

Attack narrative

The Chronodrive bundle installs an XMLHttpRequest.send hook at runtime, extracts pwd_login from successful retailer login requests, and saves it under _miam/userPwd. Its basket flow reads that value and posts it with the user ID to Chronodrive's mobile login endpoint to obtain a token, then uses that token to alter the cart. This is concrete credential interception and replay despite the endpoint being retailer-aligned.

Rationale

The package has no install hook, but its runtime code actively captures and persists a password by tampering with a browser networking primitive. The aligned endpoint reduces third-party exfiltration evidence but does not remove the unconsented credential-capture behavior.

Evidence

package.jsonmealz-injector-chronodrive.jsmealz-injector-chronodrive.js.maplocalStorage:_miam/userPwd

Network endpoints2

www.chronodrive.com/mobile/ws/loginwww.chronodrive.com/mobile/ws/SendCart

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

mealz-injector-chronodrive.js.map captures login-form password by replacing XMLHttpRequest.prototype.send.
It persists the captured password in localStorage as _miam/userPwd.
It automatically reuses that password in a POST to Chronodrive's mobile login endpoint.
Chronodrive main invokes interceptUserPwd at runtime; no user command gates it.

Evidence against

package.json has no npm lifecycle hooks.
Observed credential POST target is chronodrive.com, not an unrelated host.

Behavioral surface

Source

ChildProcessNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 7 file(s), 284 KB of source, external domains: courses.monoprix.fr, qualif.coursesu.com, ssr-api-uat.mealz.ai, ssr-api.mealz.ai, static1.chronodrive.com, storage.googleapis.com, www.carrefour.fr, www.chronodrive.com, www.coursesu.com, www.rte.casino.osp.world

Source & flagged code

1 flagged

mealz-injector-chronodrive.jsView file

Lines 1-4javascript

1!function(){"use strict";try{if("undefined"!=typeof document){var e=document.createElement("style");e.appendChild(document.createTextNode("body{overflow:hidden!important}@keyframes open{0%{right:-800px}to{right:0}}:root{--miam-color-primary: #8caa0a;--miam-color-secondary: #da291c;--oftenDeleted-color: #88cbf9;--miam-unavailable-color: #ec7981;--miam-removed-color: #faae31c2;--miam-font-size-medium: 16px;--miam-font-size-small: 14px;color:#3c3c37}:root .miam-hidden{display:none!important}:root .miamRecipeCardContainer{padding:0;border:none}:root .icon-container{background:none}:root .miam-coun ..

Source & flagged code

1 flagged · loading source

mealz-injector-chronodrive.jsView file

1!function(){"use strict";try{if("undefined"!=typeof document){var e=document.createElement("style");e.appendChild(document.createTextNode("body{overflow:hidden!important}@keyframes... L2: var e=Object.defineProperty,t=(t,r,i)=>((t,r,i)=>r in t?e(t,r,{enumerable:!0,configurable:!0,writable:!0,value:i}):t[r]=i)(t,"symbol"!=typeof r?r+"":r,i);import{U as r,S as i,R as ... L3: //# sourceMappingURL=mealz-injector-chronodrive.js.map

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

mealz-injector-chronodrive.jsView on unpkg · L1

Findings

1 Critical1 Medium4 Low

CriticalBuiltin Api Tampering Exfiltrationmealz-injector-chronodrive.js

MediumNetwork

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Minified

UrlStrings

CopyleftLicense

LPM CLI

Source & flagged code

1 flagged

mealz-injector-chronodrive.jsView file

Lines 1-4javascript

1!function(){"use strict";try{if("undefined"!=typeof document){var e=document.createElement("style");e.appendChild(document.createTextNode("body{overflow:hidden!important}@keyframes open{0%{right:-800px}to{right:0}}:root{--miam-color-primary: #8caa0a;--miam-color-secondary: #da291c;--oftenDeleted-color: #88cbf9;--miam-unavailable-color: #ec7981;--miam-removed-color: #faae31c2;--miam-font-size-medium: 16px;--miam-font-size-small: 14px;color:#3c3c37}:root .miam-hidden{display:none!important}:root .miamRecipeCardContainer{padding:0;border:none}:root .icon-container{background:none}:root .miam-coun ..

.

2var e=Object.defineProperty,t=(t,r,i)=>((t,r,i)=>r in t?e(t,r,{enumerable:!0,configurable:!0,writable:!0,value:i})

3//# sourceMappingURL=mealz-injector-chronodrive.js.map

Critical

Builtin Api Tampering Exfiltration

Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.

mealz-injector-chronodrive.jsView on unpkg · L1

4

Long lines were clipped for display.

:

t[r]

=

i)(t,

"symbol"

!=typeof

r

?

r

+

""

:

r,i);import{U

as

r

,S

as

i

,R

as

a

,C

as

s

,a

as

n

}from

"./mealz-injector-store-wrapper.js"

;

class

o

{

constructor

(

e

,

r

,

i

=!

1

){

t

(

this

,

"_cardWrapper"

),

t

(

this

,

"_firstChange"

,

!

0

),

t

(

this

,

"listMutationObserver"

),

this

._cardWrapper

=

r,

this

.

modifyHelperString

(),

this

.

initListMutationObserver

(e),i

&&

this

.

injectCardsPlaceholders

(e)}initListMutationObserver(e){this.listMutationObserver=new MutationObserver(this.onDomChangeCallback.bind(this)),this.listMutationObserver.ob ...