xchange-cli@0.12.20
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe desktop app starts sponsored-card requests by default and reports authenticated ad interaction metrics. I found no disclosure of this runtime reporting in the inspected package description, so I classify it as suspicious telemetry rather than malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Electron app startup for eligible accounts, unless XCHANGE_ADS=0.
Impact
The service can receive ad display and interaction metrics, including creative ID, display time, dwell time, and outcome.
Mechanism
The app obtains an ad credential using its configured service URL and session token, fetches sponsored cards, and submits authenticated interaction receipts.
AI rationale
The desktop app starts sponsored-card requests by default and reports authenticated ad interaction metrics. I found no disclosure of this runtime reporting in the inspected package description, so I classify it as suspicious telemetry rather than malicious behavior.
Evidence
dist/app/dist/main.jsdist/app/dist/ads.jsApp state under XCHANGE_HOME (filename is obfuscated in dist/app/dist/main.js)App log under XCHANGE_HOME (filename is obfuscated in dist/app/dist/main.js)
Network endpoints2
Configured serviceUrl from app stateAPI_ORIGIN constant in dist/app/dist/ads.js (hostname is obfuscated in the inspected bundle)
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The Electron app starts the sponsored-card watcher when ready; it returns early only when XCHANGE_ADS is set to "0".
- For eligible accounts, the watcher uses the app state’s service URL and session token to request an ad credential.
- The ads module fetches creatives and sends authenticated outcome receipts containing creative IDs, display times, dwell times, and outcomes.
Evidence against
- The manifest has no install, preinstall, or postinstall hook.
- The observed ad flow uses the app’s configured service and session credentials; I found no transfer of other providers’ credentials or user code in that flow.
- The reported fields are ad interaction metrics, and the feature has an environment-variable opt-out.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
6 flaggeddist/cli/src/systemd.jsView file
1const u=d,v=d,w=d;(function(h,i){const n=d,o=d,p=d,j=h();while(!![]){try{const k=parseInt(n(0x17c))/(-0xf+0x3*-0x1ea+-0x2*-0x2e7)*(parseInt(n(0x12c))/(-0x487+-0x2172+-0x1*-0x25fb))...
High
Child Process
Package source references child process execution.
dist/cli/src/systemd.jsView on unpkg · L1bin/xchange.jsView file
11const entry = fs.existsSync(built) ? built : path.join(root, "packages", "cli", "src", "index.ts");
L12: await import(pathToFileURL(entry).href);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/xchange.jsView on unpkg · L11dist/app/dist/main.jsView file
1
Findings
6 High4 Medium5 Low
HighChild Processdist/cli/src/systemd.js
HighShell
HighSame File Env Network Executiondist/app/dist/main.js
HighObfuscated Payload Loaderdist/ui/presets-fallback.js
HighCross File Remote Execution Contextdist/cli/src/index.js
HighSemantic Analysis Limiteddist/app/dist/ads.js#virtual:normalized:round1
MediumDynamic Requirebin/xchange.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowCopyleft License
Affected versions and remediation
This report applies to xchange-cli@0.12.20.
See all versions of xchange-cli for other recorded verdicts.
- Review the evidence and your use of xchange-cli@0.12.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.