registry / Credential exfiltration / xchange-cli
xchange-cli
Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs o
This report shows the evidence for xchange-cli@0.12.18. 5 of 16 known versions are blocked or flagged. The newest version, 0.12.31, is flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe desktop app automatically forwards the included-AI account credential to its sponsored-card service in authenticated requests. Because this credential is for the included AI service and is sent without an explicit sharing action, this is credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Electron app startup; the ad loop runs on startup and every 60 seconds when an eligible account has a token.
Impact
The ad service receives a credential used by the included AI account, without an explicit user action to share that credential with the ad service.
Mechanism
The app reads includedAi.token from account.json, selects it or a house credential, then attaches the selected token as a Bearer credential to requests to the ad service.
Attack narrative
When the desktop app becomes ready, it starts sponsored-card handling. The app reads the included-AI token from account.json and the ad loop automatically uses that token or a house credential for requests to adcode.bluethenics.com, sending it in a Bearer header. This exposes an account credential to the ad service without an explicit user request to share it.
AI rationale
The desktop app automatically forwards the included-AI account credential to its sponsored-card service in authenticated requests. Because this credential is for the included AI service and is sent without an explicit sharing action, this is credential exfiltration.
Evidence
dist/app/dist/main.jsdist/app/dist/ads.jsaccount.jsonlogs/ads.log
Network endpoints1
adcode.bluethenics.com
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The desktop app starts sponsored-card handling automatically when Electron is ready.
- Startup reads account.json and uses parsed.includedAi.token as its account token.
- The sponsored-card service is adcode.bluethenics.com.
- The ad client selects a token and sends it as a Bearer credential to the ad service.
- For paid accounts, the app also obtains a house credential using the account session token.
Evidence against
- package.json defines no install, preinstall or postinstall lifecycle script.
- The update code downloads and runs an installer only through the explicit update command.
- The ad requests serve sponsored cards, the feature's stated purpose.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggeddist/app/dist/claude-desktop.jsView file
6exports.claudeStartedAt = claudeStartedAt;
L7: const node_child_process_1 = require("node:child_process");
L8: const MAC_BUNDLE_ID = "com.anthropic.claudefordesktop";
High
Child Process
Package source references child process execution.
dist/app/dist/claude-desktop.jsView on unpkg · L6dist/cli/src/schtasks.js#virtual:normalized:round1View file
18import path from "node:path";
L19: import { windowsPowerShellEnv } from "./windows-powershell.js";
L20: import { runtime } from "./runtime.js";
High
Shell
Package source references shell execution.
dist/cli/src/schtasks.js#virtual:normalized:round1View on unpkg · L18•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
Findings
1 Critical16 High5 Medium6 Low
CriticalDownload Executedist/cli/src/update.js
HighChild Processdist/app/dist/claude-desktop.js
HighShelldist/cli/src/schtasks.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/cli/src/update.js
HighSemantic Analysis Limiteddist/cli/src/schtasks.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/app/dist/main.js
HighKnown Malware Source Similaritydist/cli/src/supervisor.js
HighKnown Malware Source Similaritydist/remote/src/bridge-client.js
HighKnown Malware Source Similaritydist/remote/src/desktop.js
HighKnown Malware Source Similaritydist/router/src/remote-host.js
Affected versions and remediation
This report applies to xchange-cli@0.12.18.
The versions list below shows the verdict for each recorded version.
- Avoid installing xchange-cli@0.12.18. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.