xchange-cli@0.12.13
Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs o
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe tray app silently forwards the user’s included-AI relay credential to the separate ad service during startup and recurring ad requests. This is automatic credential exfiltration, even though the requests support the package’s sponsored-card feature.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Electron tray app startup for an account with a paid plan and an included-AI token; it repeats on a timer unless `XCHANGE_ADS=0`.
Impact
The ad service receives a credential intended for the included-AI relay, potentially exposing the user’s relay access or quota without consent.
Mechanism
The app reads `includedAi.token` from its account file and passes it to the ads module, which places it in Bearer authorization headers for requests to the ad service.
Attack narrative
When the tray app starts, it reads the included-AI bearer token from the account file and passes it to the sponsored-ads module. The module sends that token automatically to adcode.bluethenics.com for ad configuration and creatives, and uses it for receipts. This credential is used by the built-in AI relay, so the ad service receives access credentials without a request to show ads or send the token.
AI rationale
The tray app silently forwards the user’s included-AI relay credential to the separate ad service during startup and recurring ad requests. This is automatic credential exfiltration, even though the requests support the package’s sponsored-card feature.
Evidence
dist/router/src/account.jsdist/app/dist/main.jsdist/app/dist/ads.js~/.xchange/account.json (read)
Network endpoints3
adcode.bluethenics.com/v1/configadcode.bluethenics.com/v1/serveadcode.bluethenics.com/v1/receipts
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The account’s `includedAi.token` is the Bearer credential for XChange’s built-in included-AI provider.
- The tray app reads `includedAi.token` from its account file and supplies that value as the ads module’s `ownToken`.
- Sponsored-card startup runs when the Electron app is ready; it is disabled only when `XCHANGE_ADS=0`.
- The ads module sends its token as a Bearer credential to `https://adcode.bluethenics.com/v1/config` and `/v1/serve`.
- The ad module also uses the token for ad receipts at `/v1/receipts`.
- The ad requests happen automatically during app startup and recur on a timer, without a user request to send the included-AI credential.
Evidence against
- The code presents the cards as sponsored ads and uses the credential to fetch ad settings and creatives.
- The ad flow is limited to accounts with a non-free plan and an included-AI token.
- The updater’s download-and-run path is part of the explicit `xchange update` command and fetches the project’s own installer.
Behavioral surface
ChildProcessCrypto
Source & flagged code
20 flaggeddist/app/dist/claude-desktop.jsView file
6exports.claudeStartedAt = claudeStartedAt;
L7: const node_child_process_1 = require("node:child_process");
L8: const MAC_BUNDLE_ID = "com.anthropic.claudefordesktop";
High
Child Process
Package source references child process execution.
dist/app/dist/claude-desktop.jsView on unpkg · L6dist/cli/src/schtasks.js#virtual:normalized:round1View file
18import path from "node:path";
L19: import { windowsPowerShellEnv } from "./windows-powershell.js";
L20: export const TASK_NAME = "XChangeRouter";
High
Shell
Package source references shell execution.
dist/cli/src/schtasks.js#virtual:normalized:round1View on unpkg · L18•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
Findings
1 Critical16 High5 Medium6 Low
CriticalDownload Executedist/cli/src/update.js
HighChild Processdist/app/dist/claude-desktop.js
HighShelldist/cli/src/schtasks.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/cli/src/update.js
HighSemantic Analysis Limiteddist/cli/src/schtasks.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/app/dist/main.js
HighKnown Malware Source Similaritydist/remote/src/bridge-client.js
HighKnown Malware Source Similaritydist/remote/src/desktop.js
HighKnown Malware Source Similaritydist/router/src/remote-host.js
HighKnown Malware Source Similaritydist/cli/src/claude-auth.js
Affected versions and remediation
This report applies to xchange-cli@0.12.13.
See all versions of xchange-cli for other recorded verdicts.
- Avoid installing xchange-cli@0.12.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.