tdem-electron-sdk
tdem sdk for electron applications
This report shows the evidence for tdem-electron-sdk@0.4.4. 0 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package provides Electron monitoring, but renderer startup silently derives an identifying user ID from page cookies and includes it in telemetry. This is undisclosed identity-bearing runtime telemetry, so the package is suspicious rather than malicious.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An application initializes the renderer SDK in a page with a matching `uin` or `bilive_uin` cookie.
Impact
Monitoring events can be correlated with a logged-in account identity. The reviewed source does not show the cookie or an authentication credential being transmitted.
Mechanism
Initialization copies the cookie value into `userId`; event identity data includes that value as `user_id` and is reported to the configured TDEM service.
AI rationale
The package provides Electron monitoring, but renderer startup silently derives an identifying user ID from page cookies and includes it in telemetry. This is undisclosed identity-bearing runtime telemetry, so the package is suspicious rather than malicious.
Evidence
lib/tdemelectron-renderer.cjsREADME.md
Network endpoints1
dem.rumt-zh.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Renderer initialization automatically extracts `uin` or `bilive_uin` from `document.cookie` and assigns it to `userId`.
- The event identity envelope includes configured `userId` as `user_id`.
- The renderer bundle contains the default reporting host `https://dem.rumt-zh.com`.
- The README describes the package as an Electron monitoring SDK and documents renderer initialization with an optional `userId`.
Evidence against
- The package’s stated purpose is collecting Electron application monitoring data.
- Collection starts when the application initializes the renderer SDK; no install-time reporting hook is declared.
- Session replay is configured separately in the documented initialization example.
- I found no source showing that the cookie value itself, credentials, or account actions are sent or performed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
Source & flagged code
8 flaggedscripts/check-node-sdk-contract.jsView file
2const { createRequire } = require('module');
L3: const { execFileSync } = require('child_process');
L4:
High
Child Process
Package source references child process execution.
scripts/check-node-sdk-contract.jsView on unpkg · L21const path = require('path');
L2: const { createRequire } = require('module');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/check-node-sdk-contract.jsView on unpkg · L1lib/tdemelectron-renderer.cjsView file
•Browser cookie sent to a fixed external endpoint in lib/tdemelectron-renderer.cjs:
var Yo=Object.defineProperty;var $g=Object.getOwnPropertyDescriptor;var qg=Object.getOwnPropertyNames;var Gg=Object.prototype.hasOwnProperty;var Vg=(e,t)=>{for(var r in t)Yo(e,r,{g...
`);R.ret=Ee,R.isErr=+le,R.payload=s;let de=Is(!!S,le),Ce=ks(R==null?void 0:R.duration,e,R),ut=de!==ve.API_RESPONSE?de:Ce?ve.SLOW_NET_REQUEST:de,qe=o.__tdemRequestId||"";o.__tdemReq...
https://evilmartians.com/chronicles/postcss-8-plugin-migration`),process.env.LANG&&process.env.LANG.startsWith("cn")&&console.warn(S+`: \u91CC\u9762 postcss.plugin \u88AB\u5F03\u75...
https://www.w3ctech.com/topic/2226`));let C=y(...x);return C.postcssPlugin=S,C.postcssVersion=new i().version,C}let R;return Object.defineProperty(w,"postcss",{get()
Findings
2 Critical4 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationlib/tdemelectron-renderer.cjs
CriticalPrevious Version Dangerous Deltalib/tdemelectron-main.cjs
HighChild Processscripts/check-node-sdk-contract.js
HighBrowser Session Account Hijacklib/tdemelectron-renderer.mjs
HighCommand Output Exfiltrationlib/tdemelectron-main.cjs
HighTrigger Reachable Command Output Exfiltrationlib/tdemelectron-main.mjs
MediumDynamic Requirescripts/check-node-sdk-contract.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprebuilds/darwin-x64/tdem-dial.node
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to tdem-electron-sdk@0.4.4.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of tdem-electron-sdk@0.4.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.