Kuaidi100 Package Tracker

• Analyzed: May 13, 2026, 12:31 PM
• Findings: 1
• Version: 1.0.0
• Hash: df65a38071c92757702ee55bc63e4b9c6962b1cc375e769acd14edffd60d9b70
• Source: palm
• External report: View on VirusTotal

Findings (1)

The package-tracker skill bundle is a legitimate tool designed to track Chinese domestic shipments via the Kuaidi100 API and sync delivery reminders to Google Calendar. The implementation uses a Node.js wrapper (index.ts) to execute a Python core (tracker_core.py) using execFile with JSON-encoded arguments, which is a secure pattern for inter-process communication. It includes appropriate security measures such as webhook rate limiting, token-based path authentication, and optional cryptographic signature verification for incoming Kuaidi100 callbacks. No evidence of data exfiltration, malicious command execution, or prompt injection was found.