DYMO.CloudflareAddin 1.6.0

DYMO.CloudflareAddin is a .NET Standard library published on NuGet by DYMOConnect (version 1.6.0 published February 12, 2026; six versions listed; still served on November 6, 2026). It extends the DYMO Label SDK with a Cloudflare R2 storage backend so the SDK can download label-consumable files from an S3-compatible bucket. It does not take credentials from the machine that uses it: the S3 client signs its requests in the ordinary way. The problem is the reverse — the package carries its own Cloudflare R2 API credentials, encrypted with a key that is also in the DLL, so anyone who has the package can recover and reuse them.

What DYMO.CloudflareAddin does

When the label SDK loads custom consumables, the library resolves a custom-consumable service and downloads paper and SKU files (XML, sometimes zipped) from a Cloudflare R2 bucket. It lists objects in the bucket named dymo-connect-webapp and downloads the ones it needs, then decompresses them into the SDK's consumables directory. It reaches dymo-connect-webapp.1f6168b5c8f9f6241fb7ff5e6ed2ac9a.r2.cloudflarestorage.com over HTTPS.

What the code does

• DYMO.CloudflareAddin.dll (lib/netstandard2.0), CustomConsumableService.get_ServiceHost: returns the R2 endpoint host 1f6168b5c8f9f6241fb7ff5e6ed2ac9a.r2.cloudflarestorage.com.
• DYMO.CloudflareAddin.dll, CustomConsumableService.get_S3Client: decrypts two hardcoded base64 strings and passes the results to new BasicAWSCredentials(...), then creates an AmazonS3Client whose ServiceURL is https:// plus the host above.
• DYMO.CloudflareAddin.dll, CryptoHelper.Decrypt / CryptoHelper.Encrypt: AES-CBC with a 128-bit key and IV derived by Rfc2898DeriveBytes (PBKDF2-SHA1, 1000 rounds) from the hardcoded password DymoLabelWriter, using the same string as the salt; the password, salt, ciphertexts and routine are all in the same DLL.
• DYMO.CloudflareAddin.dll, DownloadCustomConsumableFile and LookupCloudForCustomConsumableFiles: create an S3 GetObjectRequest with BucketName dymo-connect-webapp and list the bucket with ListObjectsV2Async before downloading.
• Decrypting the two embedded ciphertexts with the in-DLL key yields the project's Cloudflare R2 access key and secret key for the dymo-connect-webapp bucket (values withheld).

Timeline (UTC)

If you installed it

Treat the R2 credentials as compromised: anyone with the package can recover them, so they do not protect the bucket. If you maintain this package, rotate the Cloudflare R2 API token for the dymo-connect-webapp bucket and move the credentials out of the DLL into a secret the SDK obtains at runtime from the application that hosts it. As a consumer of the package, your own AWS or R2 credentials are not exposed; the harm is to the project's bucket.