xchange-cli@0.12.19
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe startup ad feature sends an account-linked included AI credential to an ad host by default, with an environment-variable opt-out. The source describes the sponsored-card feature and does not show the token going to a clearly unrelated collector, so this warrants a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Desktop app startup, unless XCHANGE_ADS=0 is set.
Impact
The ad service receives an account-linked credential and can associate ad requests with the user’s account; the source does not establish that it is an unrelated or malicious collector.
Mechanism
The app reads includedAi.token from account.json and sends it as a Bearer credential to adcode.bluethenics.com for ad configuration and creative requests.
AI rationale
The startup ad feature sends an account-linked included AI credential to an ad host by default, with an environment-variable opt-out. The source describes the sponsored-card feature and does not show the token going to a clearly unrelated collector, so this warrants a warning rather than a malicious verdict.
Evidence
dist/app/dist/main.jsdist/app/dist/ads.js
Network endpoints2
adcode.bluethenics.com/v1/configadcode.bluethenics.com/v1/serve
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- When the desktop app becomes ready, it starts sponsored cards by default; only XCHANGE_ADS=0 disables them.
- The app reads includedAi.token from account.json and passes the token to the ad service as a Bearer credential.
- The ad service uses adcode.bluethenics.com for configuration and creative requests.
Evidence against
- The source describes the feature as sponsored cards, and the app displays those cards to users.
- The update command downloads and runs the project’s installer only when an update is explicitly requested.
- The package manifest has no install, preinstall, or postinstall lifecycle script.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
20 flaggeddist/app/dist/claude-desktop.jsView file
6exports.claudeStartedAt = claudeStartedAt;
L7: const node_child_process_1 = require("node:child_process");
L8: const MAC_BUNDLE_ID = "com.anthropic.claudefordesktop";
High
Child Process
Package source references child process execution.
dist/app/dist/claude-desktop.jsView on unpkg · L6dist/cli/src/schtasks.js#virtual:normalized:round1View file
18import path from "node:path";
L19: import { windowsPowerShellEnv } from "./windows-powershell.js";
L20: import { runtime } from "./runtime.js";
High
Shell
Package source references shell execution.
dist/cli/src/schtasks.js#virtual:normalized:round1View on unpkg · L18•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
Findings
1 Critical16 High5 Medium6 Low
CriticalDownload Executedist/cli/src/update.js
HighChild Processdist/app/dist/claude-desktop.js
HighShelldist/cli/src/schtasks.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/cli/src/update.js
HighSemantic Analysis Limiteddist/cli/src/schtasks.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/app/dist/main.js
HighKnown Malware Source Similaritydist/cli/src/supervisor.js
HighKnown Malware Source Similaritydist/remote/src/bridge-client.js
HighKnown Malware Source Similaritydist/remote/src/desktop.js
HighKnown Malware Source Similaritydist/router/src/remote-host.js
Affected versions and remediation
This report applies to xchange-cli@0.12.19.
See all versions of xchange-cli for other recorded verdicts.
- Review the evidence and your use of xchange-cli@0.12.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.