xchange-cli@0.12.24
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe automatic ads module receives account-related token values and uses them in authenticated requests, while obfuscation conceals the destination and prevents confirming the flow's purpose. This is a real but unproven telemetry risk, so the package warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Desktop app startup and its recurring ads timer.
Impact
A reviewer cannot establish whether the automatic token-bearing requests go only to the package's intended service or whether account credentials are disclosed elsewhere.
Mechanism
The app passes token, ownToken, serviceUrl, and sessionToken callbacks to the ads module; that module makes authenticated network requests, but its endpoint strings are obfuscated.
AI rationale
The automatic ads module receives account-related token values and uses them in authenticated requests, while obfuscation conceals the destination and prevents confirming the flow's purpose. This is a real but unproven telemetry risk, so the package warrants a warning rather than a block.
Evidence
dist/app/dist/main.jsdist/app/dist/ads.js
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The desktop bundle automatically starts an ads module and supplies callbacks for a token, an own token, a service URL, and a session token.
- The obfuscated ads module sends requests with a Bearer authorization header to an encoded API origin; its default preset is also encoded.
- The ads module can request a house credential from the configured service URL using an authorization token.
- The executable bundles are heavily obfuscated, so the ads destination and the full purpose of the token flows cannot be verified from readable source.
Evidence against
- The manifest has no lifecycle scripts; the published bin imports the CLI entry point.
- The package describes itself as a model router and AI coding tool, which accounts for ordinary network and process use.
- The ads credential request uses the app-provided service URL rather than a readable hard-coded foreign host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
6 flaggeddist/cli/src/systemd.jsView file
1const u=d,v=d,w=d;function d(a,b){a=a-(0x54*0x5e+0x203c+0x10*-0x3e5);const e=c();let f=e[a];if(d['dKQtdv']===undefined){var g=function(j){const l='[redacted]...
High
Child Process
Package source references child process execution.
dist/cli/src/systemd.jsView on unpkg · L1bin/xchange.jsView file
11const entry = fs.existsSync(built) ? built : path.join(root, "packages", "cli", "src", "index.ts");
L12: await import(pathToFileURL(entry).href);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/xchange.jsView on unpkg · L11dist/app/dist/main.jsView file
1const B=d,C=d,E=d;(function(e,f){const u=d,v=d,w=d,g=e();while(!![]){try{const h=-parseInt(u(0x17e))/(-0x6bd+-0x1539+0x1bf7)+-parseInt(u(0xd3))/(-0x5*-0x6ca+0x7f9+-0x29e9)*(-parseI...
Findings
6 High4 Medium5 Low
HighChild Processdist/cli/src/systemd.js
HighShell
HighSame File Env Network Executiondist/app/dist/main.js
HighObfuscated Payload Loaderdist/ui/presets-fallback.js
HighCross File Remote Execution Contextdist/cli/src/index.js
HighSemantic Analysis Limiteddist/app/dist/ads.js#virtual:normalized:round1
MediumDynamic Requirebin/xchange.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowCopyleft License
Affected versions and remediation
This report applies to xchange-cli@0.12.24.
See all versions of xchange-cli for other recorded verdicts.
- Review the evidence and your use of xchange-cli@0.12.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.