registry / myxl-core / 1.0.4

myxl-core@1.0.4

MyXL API client — auth, payments, family, packages

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Calling `checkQuota(msisdn)` transmits the supplied phone number to a separate third-party host. No install-time execution or local-system mutation is present.

Static reason

No blocking static signals were detected.

Trigger

A consumer explicitly calls `Ciam.checkQuota(msisdn)`.

Impact

A caller’s phone number and quota-check intent may be disclosed to `xl-ku.my.id`.

Mechanism

Axios GET with MSISDN embedded in a third-party URL query string.

Rationale

The package lacks install-time or host-compromise behavior, but it has a concrete user-data disclosure path to a non-primary endpoint. This warrants a warning rather than a malware block.

Evidence

dist/ciam.jsdist/index.jspackage.jsondist/config.js

Network endpoints3

xl-ku.my.id/end.php?check=package&number=${msisdn}&version=2api.myxl.xlaxiata.co.idgede.ciam.xlaxiata.co.id

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

`dist/ciam.js` sends caller-supplied `msisdn` to `xl-ku.my.id`.
The quota request is an unencrypted query-string GET containing the phone number.
`xl-ku.my.id` differs from the package’s primary `xlaxiata.co.id` API hosts.

Evidence against

`package.json` has only a `prepublishOnly` hook, not install-time hooks.
No filesystem access, child processes, dynamic code execution, or persistence primitives found.
The network call is limited to the explicit exported `checkQuota(msisdn)` function.
Other API calls use the configured MyXL/XLAxiata endpoints and caller-provided tokens.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 25 file(s), 259 KB of source, external domains: api.myxl.xlaxiata.co.id, gede.ciam.xlaxiata.co.id, xl-ku.my.id

Source & flagged code

1 flagged

dist/device.jsView file

Lines 1-25javascript

1// @bun

2// src/device.ts

3import crypto from "crypto";

5// src/lib/utils.ts

6import axios from "axios";

7import { v4 as uuidv4 } from "uuid";

8import { DateTime } from "luxon";

9function unseal(getter, fallback) {

10 try {

11 const hex = getter();

12 if (!hex || typeof __SEED__ === "undefined")

13 return fallback;

14 const seed = Buffer.from(__SEED__, "hex");

15 const data = Buffer.from(hex, "hex");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/device.jsView on unpkg · L5

16 return Buffer.from(data.map((b, i) => b ^ seed[i % seed.length])).toString("utf8");

17 } catch {

18 return fallback;

19 }

20}

22// src/config.ts

23var BASE_API_URL = unseal(() => __E_BASE_API_URL__, "https://api.myxl.xlaxiata.co.id");

24var BASE_CIAM_URL = unseal(() => __E_BASE_CIAM_URL__, "https://gede.ciam.xlaxiata.co.id");

25var BASIC_AUTH = unseal(() => __E_BASIC_AUTH__, "OWZjOTdlZDEtNmEzMC00OGQ1LTk1MTYtNjBjNTNjZTNhMTM1OllEV21GNExKajlYSUt3UW56eTJlMmxiMHRKUWIyOW8z");

Source & flagged code

1 flagged · loading source

dist/device.jsView file

5// src/lib/utils.ts L6: import axios from "axios"; L7: import { v4 as uuidv4 } from "uuid"; ... L13: return fallback; L14: const seed = Buffer.from(__SEED__, "hex"); L15: const data = Buffer.from(hex, "hex");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/device.jsView on unpkg · L5

Findings

2 Medium6 Low

MediumNetwork

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/device.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License