registry / myxl-core / 1.0.2

myxl-core@1.0.2

MyXL API client — auth, payments, family, packages

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Explicit payment-decoy APIs construct mismatched purchase item, token, and target-option combinations against MyXL payment endpoints. A separate explicit quota helper transmits its supplied phone number to a third-party host.

Static reason

No blocking static signals were detected.

Trigger

Consumer calls exported `Payments.payPulsaDecoy*`, `Payments.payQrisDecoy*`, or `Ciam.checkQuota`.

Impact

May facilitate unauthorized or inconsistent telecom-payment transactions; quota lookup discloses the supplied MSISDN to a non-MyXL endpoint.

Mechanism

User-invoked payment-request manipulation and third-party MSISDN lookup.

Rationale

The package contains no install-time or host-compromise behavior, but its exported decoy flows are a material, unresolved payment-abuse capability. Flag as warn rather than block because activation is explicit and backend exploit success is not established statically.

Evidence

package.jsondist/index.jsdist/ciam.jsdist/payments/index.jsdist/payments/pulsa-decoy.d.tsdist/payments/pulsa-decoy-v2.d.tsdist/payments/qris-decoy.d.tsdist/payments/qris-decoy-v2.d.ts

Network endpoints3

api.myxl.xlaxiata.co.idgede.ciam.xlaxiata.co.idxl-ku.my.id/end.php?check=package&number=${msisdn}&version=2

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/payments/index.js` exposes Pulsa/QRIS “Decoy” payment flows.
Decoy flows pair a primary item with a different item/token and target option.
`payPulsaWithDecoy` retries using an amount parsed from `Bizz-err.Amount.Total`.
`checkQuota` sends caller-supplied MSISDN to `xl-ku.my.id`.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
No filesystem, shell, eval, dynamic-load, environment-harvesting, or persistence primitive found in `dist`.
Network requests are user-invoked API-client functions; no import-time request was found.

Behavioral surface

Source

CryptoNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 29 file(s), 436 KB of source, external domains: api.myxl.xlaxiata.co.id, gede.ciam.xlaxiata.co.id, xl-ku.my.id

Source & flagged code

1 flagged

dist/device.jsView file

Lines 1-36javascript

1// @bun

2var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

4// src/lib/encrypt-helper.ts

5var init_encrypt_helper = __esm(() => {

6 init_config();

7});

9// src/encrypt.ts

10var init_encrypt = __esm(() => {

11 init_config();

12 init_encrypt_helper();

13 init_encrypt_helper();

14});

16// src/lib/utils.ts

17import axios from "axios";

18import { v4 as uuidv4 } from "uuid";

19import { DateTime } from "luxon";

20function unseal(getter, fallback) {

21 try {

22 const hex = getter();

23 if (!hex || typeof __SEED__ === "undefined")

24 return fallback;

25 const seed = Buffer.from(__SEED__, "hex");

26 const data = Buffer.from(hex, "hex");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/device.jsView on unpkg · L16

27 return Buffer.from(data.map((b, i) => b ^ seed[i % seed.length])).toString("utf8");

28 } catch {

29 return fallback;

30 }

31}

32var init_utils = __esm(() => {

33 init_config();

34 init_encrypt();

35});

Source & flagged code

1 flagged · loading source

dist/device.jsView file

16// src/lib/utils.ts L17: import axios from "axios"; L18: import { v4 as uuidv4 } from "uuid"; ... L24: return fallback; L25: const seed = Buffer.from(__SEED__, "hex"); L26: const data = Buffer.from(hex, "hex");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/device.jsView on unpkg · L16

Findings

2 Medium5 Low

MediumNetwork

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptodist/device.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License