tdem-electron-sdk@0.4.4
tdem sdk for electron applications
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package provides Electron monitoring, but renderer startup silently derives an identifying user ID from page cookies and includes it in telemetry. This is undisclosed identity-bearing runtime telemetry, so the package is suspicious rather than malicious.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An application initializes the renderer SDK in a page with a matching `uin` or `bilive_uin` cookie.
Impact
Monitoring events can be correlated with a logged-in account identity. The reviewed source does not show the cookie or an authentication credential being transmitted.
Mechanism
Initialization copies the cookie value into `userId`; event identity data includes that value as `user_id` and is reported to the configured TDEM service.
AI rationale
The package provides Electron monitoring, but renderer startup silently derives an identifying user ID from page cookies and includes it in telemetry. This is undisclosed identity-bearing runtime telemetry, so the package is suspicious rather than malicious.
Evidence
lib/tdemelectron-renderer.cjsREADME.md
Network endpoints1
dem.rumt-zh.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Renderer initialization automatically extracts `uin` or `bilive_uin` from `document.cookie` and assigns it to `userId`.
- The event identity envelope includes configured `userId` as `user_id`.
- The renderer bundle contains the default reporting host `https://dem.rumt-zh.com`.
- The README describes the package as an Electron monitoring SDK and documents renderer initialization with an optional `userId`.
Evidence against
- The package’s stated purpose is collecting Electron application monitoring data.
- Collection starts when the application initializes the renderer SDK; no install-time reporting hook is declared.
- Session replay is configured separately in the documented initialization example.
- I found no source showing that the cookie value itself, credentials, or account actions are sent or performed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedscripts/check-node-sdk-contract.jsView file
2const { createRequire } = require('module');
L3: const { execFileSync } = require('child_process');
L4:
High
Child Process
Package source references child process execution.
scripts/check-node-sdk-contract.jsView on unpkg · L21const path = require('path');
L2: const { createRequire } = require('module');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/check-node-sdk-contract.jsView on unpkg · L1lib/tdemelectron-renderer.cjsView file
•Browser cookie sent to a fixed external endpoint in lib/tdemelectron-renderer.cjs:
var Yo=Object.defineProperty;var $g=Object.getOwnPropertyDescriptor;var qg=Object.getOwnPropertyNames;var Gg=Object.prototype.hasOwnProperty;var Vg=(e,t)=>{for(var r in t)Yo(e,r,{g...
`);R.ret=Ee,R.isErr=+le,R.payload=s;let de=Is(!!S,le),Ce=ks(R==null?void 0:R.duration,e,R),ut=de!==ve.API_RESPONSE?de:Ce?ve.SLOW_NET_REQUEST:de,qe=o.__tdemRequestId||"";o.__tdemReq...
https://evilmartians.com/chronicles/postcss-8-plugin-migration`),process.env.LANG&&process.env.LANG.startsWith("cn")&&console.warn(S+`: \u91CC\u9762 postcss.plugin \u88AB\u5F03\u75...
https://www.w3ctech.com/topic/2226`));let C=y(...x);return C.postcssPlugin=S,C.postcssVersion=new i().version,C}let R;return Object.defineProperty(w,"postcss",{get()
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
lib/tdemelectron-renderer.cjsView on unpkglib/tdemelectron-renderer.mjsView file
1var St=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar...
L2: Error.stack: ${r.stack}`;if(typeof r=="object"&&r!==null){if(e.has(r))return`[Circular ${t||"root"}]`;e.add(r)}return r}},Yr=function(e){if(typeof e=="string")return e;try{return e...
...
L5: ${t.message}
L6: ${t.stack}`}},os=function(e,t=3){let r="";if(Array.isArray(e)){r+="[";let n=e.length;e.forEach((i,o)=>{typeof i=="object"&&t>1?r+=os(i,t-1):r+=Xg(i),r+=`${o===n-1?"":","}`}),r+="]"...
L7: `),n=0;for(let i of r){let o=i.match(/at\s+(.+?)\s+\((.+?):(\d+):(\d+)\)/);if(o){let[,s,l,c,u]=o,a=l.split("/").pop()||l;t.push({abs_path:l,colno:parseInt(u,10),filename:a,function...
L8: `).reduce((r,n)=>{let i
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
lib/tdemelectron-renderer.mjsView on unpkg · L1lib/tdemelectron-main.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = tdem-electron-sdk@0.4.3
matchedIdentity = npm:dGRlbS1lbGVjdHJvbi1zZGs:0.4.3
similarity = 0.611
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/tdemelectron-main.cjsView on unpkg13.catch((error) => parentPort.postMessage({ error: error && error.message ? error.message : String(error) }));
L14: `;var js={maxZipBytes:5242880,maxInputBytes:64*1024*1024,maxSingleFileBytes:16*1024*1024,maxEntries:1024,maxDepth:32,timeoutMs:1e4},ai=(t,e)=>{try{qe.rmSync(fr.join(t.artifactDirec...
L15: `),o(`Content-Disposition: form-data; name="payload"\r
...
L28: `)}return o(`--${n}--\r
L29: `),{contentType:`multipart/form-data; boundary=${n}`,body:Buffer.concat(i)}},Ys=t=>{let e=t&&typeof t=="object"&&"body"in t?t.body:t,r=typeof e=="string"?Xs(e):e,n=r&&typeof r=="ob...
L30: const { parentPort, workerData } = require('worker_threads');
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
lib/tdemelectron-main.cjsView on unpkg · L13lib/tdemelectron-main.mjsView file
13Trigger-reachable command-output exfiltration chain: manifest.exports -> lib/main.mjs -> lib/tdemelectron-main.mjs
L13: .catch((error) => parentPort.postMessage({ error: error && error.message ? error.message : String(error) }));
L14: `;var ws={maxZipBytes:5242880,maxInputBytes:64*1024*1024,maxSingleFileBytes:16*1024*1024,maxEntries:1024,maxDepth:32,timeoutMs:1e4},ei=(t,e)=>{try{Ne.rmSync(ar.join(t.artifactDirec...
L15: `),o(`Content-Disposition: form-data; name="payload"\r
...
L28: `)}return o(`--${n}--\r
L29: `),{contentType:`multipart/form-data; boundary=${n}`,body:Buffer.concat(i)}},Ns=t=>{let e=t&&typeof t=="object"&&"body"in t?t.body:t,r=typeof e=="string"?Fs(e):e,n=r&&typeof r=="ob...
L30: const { parentPort, workerData } = require('worker_threads');
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
lib/tdemelectron-main.mjsView on unpkg · L13prebuilds/darwin-x64/tdem-dial.nodeView file
•path = prebuilds/darwin-x64/tdem-dial.node
kind = native_binary
sizeBytes = 38312
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
prebuilds/darwin-x64/tdem-dial.nodeView on unpkgFindings
2 Critical4 High5 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationlib/tdemelectron-renderer.cjs
CriticalPrevious Version Dangerous Deltalib/tdemelectron-main.cjs
HighChild Processscripts/check-node-sdk-contract.js
HighBrowser Session Account Hijacklib/tdemelectron-renderer.mjs
HighCommand Output Exfiltrationlib/tdemelectron-main.cjs
HighTrigger Reachable Command Output Exfiltrationlib/tdemelectron-main.mjs
MediumDynamic Requirescripts/check-node-sdk-contract.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprebuilds/darwin-x64/tdem-dial.node
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tdem-electron-sdk@0.4.4.
See all versions of tdem-electron-sdk for other recorded verdicts.
- Review the evidence and your use of tdem-electron-sdk@0.4.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.