xchange-cli@0.12.26
Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs o
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe app sends sponsored-ad engagement receipts automatically at runtime, while its README claims there is no telemetry. The observed flow appears limited to ad delivery and reporting, so this warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
Electron app startup; the watcher runs unless `XCHANGE_ADS=0`, and proceeds when stored plan and token fields are present.
Impact
Sends ad engagement details to the ad service without disclosure; no unrelated credential theft was identified.
Mechanism
Reads local account/session configuration, requests an ad credential from the configured service URL, fetches sponsored content, and reports display receipts. The relevant endpoint strings are obfuscated in the bundle.
AI rationale
The app sends sponsored-ad engagement receipts automatically at runtime, while its README claims there is no telemetry. The observed flow appears limited to ad delivery and reporting, so this warrants a warning rather than a malicious verdict.
Evidence
dist/app/dist/main.jsdist/app/dist/ads.jsREADME.mdlocal Xchange account configuration (path assembled in bundle)
Network endpoints2
API_ORIGIN in dist/app/dist/ads.js (host and route obfuscated)Configured serviceUrl from local account configuration
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Electron app starts the sponsored-card watcher on startup; its opt-out is `XCHANGE_ADS=0`.
- The watcher reads stored account/session configuration and uses the configured service URL and session token to obtain an ad credential.
- The ad module sends authenticated requests to its ad API and reports ad display outcomes, including creative ID, display time, dwell time, and outcome.
- The README says the package has no telemetry, without disclosing the sponsored-card requests or outcome reporting.
Evidence against
- The ad flow appears tied to the package’s sponsored-card feature and requires stored plan and token fields.
- The credential request uses a configured service URL, and the inspected code did not show credentials for unrelated services being collected or sent.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
6 flaggeddist/cli/src/systemd.jsView file
1const u=d,v=d,w=d;(function(h,i){const n=d,o=d,p=d,j=h();while(!![]){try{const k=-parseInt(n(0x163))/(0x1*0x11fe+0x484+-0x1681)*(parseInt(o(0x1a0))/(-0x11*0x21e+0x1a24+0x9dc))+-par...
High
Child Process
Package source references child process execution.
dist/cli/src/systemd.jsView on unpkg · L1bin/xchange.jsView file
11const entry = fs.existsSync(built) ? built : path.join(root, "packages", "cli", "src", "index.ts");
L12: await import(pathToFileURL(entry).href);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/xchange.jsView on unpkg · L11dist/app/dist/main.jsView file
1
Findings
6 High4 Medium5 Low
HighChild Processdist/cli/src/systemd.js
HighShell
HighSame File Env Network Executiondist/app/dist/main.js
HighObfuscated Payload Loaderdist/ui/three.module.js
HighCross File Remote Execution Contextdist/cli/src/index.js
HighSemantic Analysis Limiteddist/app/dist/ads.js#virtual:normalized:round1
MediumDynamic Requirebin/xchange.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowCopyleft License
Affected versions and remediation
This report applies to xchange-cli@0.12.26.
See all versions of xchange-cli for other recorded verdicts.
- Review the evidence and your use of xchange-cli@0.12.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.