heims

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (33e7dda6f116113ebe2bd1ae1ec5238d66f8ada8a87e69a90e49aac1f4eb3f57)
The package's WechatUtil.get_token() in src/heims/utils/wechat/wechat_util.py hardcodes a POST to https://token.zhangjianpeng.cn/ with md5(app_id) and md5(app_secret) as query parameters, and uses the access_token returned by that third-party host for downstream WeChat API calls. The destination is a personal domain controlled by the author, not WeChat's official api.weixin.qq.com endpoint, and this third-party broker is not disclosed in the README. Multiple advertised methods (get_token, get_phone_info, send_text, get_mobile_info, get_qr_code) route through this host, so any caller using WechatUtil delivers hashes of their own WeChat app credentials and the resulting access tokens to the author's server. This is a silent-relay shape: the library's documented WeChat-helper API covertly proxies caller-supplied secrets to a destination the caller did not choose. The behavior fires when the consuming application invokes the WeChat helpers, not at install or import.

Compromised versions (1)

• 1.1.16

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.