xchange-cli@0.12.12
Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs o
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe app automatically sends a persisted included AI account token to its sponsored-ad service as a bearer credential. That is credential exfiltration to a separate host without user consent, so this version should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Electron app startup, followed by the sponsored-card timer.
Impact
The ad service receives a credential belonging to the user's XChange account without a per-request user action or opt-in.
Mechanism
The app supplies the account's included AI token as an ads credential and sends it as a bearer token to the ad service.
Attack narrative
When the desktop app starts, it starts sponsored cards automatically. The app reads the included AI token from its account file, passes it to the ads module as the account's own credential, and the module sends it as a bearer token to adcode.bluethenics.com. This exposes an account credential to the ad service without a user action or opt-in.
AI rationale
The app automatically sends a persisted included AI account token to its sponsored-ad service as a bearer credential. That is credential exfiltration to a separate host without user consent, so this version should be blocked.
Evidence
dist/app/dist/main.jsdist/app/dist/ads.jsaccount.json under the app home (read)
Network endpoints3
adcode.bluethenics.com/v1/configadcode.bluethenics.com/v1/serveadcode.bluethenics.com/v1/receipts
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The desktop app reads the persisted included AI token from its account file.
- It passes that token to the sponsored-card code as the account's own token.
- Sponsored-card requests send a bearer token to adcode.bluethenics.com.
- Sponsored cards start automatically when the Electron app is ready.
Evidence against
- The package declares no install lifecycle scripts.
- The updater's download-and-run behavior is part of the explicit xchange update command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
8 flaggeddist/app/dist/claude-desktop.jsView file
6exports.claudeStartedAt = claudeStartedAt;
L7: const node_child_process_1 = require("node:child_process");
L8: const MAC_BUNDLE_ID = "com.anthropic.claudefordesktop";
High
Child Process
Package source references child process execution.
dist/app/dist/claude-desktop.jsView on unpkg · L6dist/cli/src/schtasks.js#virtual:normalized:round1View file
18import path from "node:path";
L19: import { windowsPowerShellEnv } from "./windows-powershell.js";
L20: export const TASK_NAME = "XChangeRouter";
High
Shell
Package source references shell execution.
dist/cli/src/schtasks.js#virtual:normalized:round1View on unpkg · L18•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
Findings
1 Critical4 High5 Medium6 Low
CriticalDownload Executedist/cli/src/update.js
HighChild Processdist/app/dist/claude-desktop.js
HighShelldist/cli/src/schtasks.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/cli/src/update.js
HighSemantic Analysis Limiteddist/cli/src/schtasks.js#virtual:normalized:round1
MediumDynamic Requirebin/xchange.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/remote/src/service.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/router/src/ingress/client-server.js
LowFilesystem
Affected versions and remediation
This report applies to xchange-cli@0.12.12.
See all versions of xchange-cli for other recorded verdicts.
- Avoid installing xchange-cli@0.12.12. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.