xchange-cli@0.12.22
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe desktop build automatically serves sponsored cards and reports receipts, while the README says there are no ads or tracking. This is undisclosed runtime telemetry, but the inspected code does not establish theft of credentials belonging to another service.
Static reason
One or more suspicious static signals were detected.
Trigger
Electron app startup when account configuration contains the required plan and session fields; XCHANGE_ADS=0 disables the watcher.
Impact
Unannounced ad tracking may associate account authorization with sponsored-card requests and interaction receipts.
Mechanism
The app obtains a house credential through the configured service URL, then uses it for sponsored-card requests and authenticated receipt reports. The relevant endpoint strings are obfuscated in the published code.
AI rationale
The desktop build automatically serves sponsored cards and reports receipts, while the README says there are no ads or tracking. This is undisclosed runtime telemetry, but the inspected code does not establish theft of credentials belonging to another service.
Evidence
dist/app/dist/main.jsdist/app/dist/ads.jsREADME.md
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The desktop app starts a sponsored-card watcher when Electron is ready; its only visible opt-out is XCHANGE_ADS=0.
- The watcher reads account fields from local configuration and requests a house credential using the configured service URL and session token.
- The obfuscated ads module fetches sponsored creatives and sends authenticated receipts to API_ORIGIN.
- The README says the service has “No account, no ads, no tracking,” which conflicts with the automatic sponsored-card flow.
Evidence against
- The session token is passed to the configured service URL to obtain a separate house credential; the inspected code does not show discovery of credentials for other services.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
6 flaggeddist/cli/src/systemd.jsView file
1const u=d,v=d,w=d;(function(h,i){const n=d,o=d,p=d,j=h();while(!![]){try{const k=parseInt(n(0x175))/(-0xbb8+-0xe41+0x5*0x532)+-parseInt(o(0x190))/(0xc94+0x1*-0x351+-0x941)*(parseIn...
High
Child Process
Package source references child process execution.
dist/cli/src/systemd.jsView on unpkg · L1bin/xchange.jsView file
11const entry = fs.existsSync(built) ? built : path.join(root, "packages", "cli", "src", "index.ts");
L12: await import(pathToFileURL(entry).href);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/xchange.jsView on unpkg · L11dist/app/dist/main.jsView file
1
Findings
6 High4 Medium5 Low
HighChild Processdist/cli/src/systemd.js
HighShell
HighSame File Env Network Executiondist/app/dist/main.js
HighObfuscated Payload Loaderdist/ui/presets-fallback.js
HighCross File Remote Execution Contextdist/cli/src/index.js
HighSemantic Analysis Limiteddist/app/dist/ads.js#virtual:normalized:round1
MediumDynamic Requirebin/xchange.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowCopyleft License
Affected versions and remediation
This report applies to xchange-cli@0.12.22.
See all versions of xchange-cli for other recorded verdicts.
- Review the evidence and your use of xchange-cli@0.12.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.