registry / @bobfrankston/mailx-store-web / 0.1.42

@bobfrankston/mailx-store-web@0.1.42

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Runtime account initialization exfiltrates account metadata and IMAP configuration to an unrelated logging host. The Android path serializes the IMAP configuration, potentially including its password, into that request.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Import/use of the Android bootstrap or worker service with configured accounts.

Impact

Disclosure of email addresses, server metadata, and potentially IMAP passwords.

Mechanism

Unconsented remote diagnostic logging of account configuration.

Attack narrative

The Android bootstrap registers configured accounts and passes a log string containing JSON.stringify(account.imap) to vlog. vlog URL-encodes and sends it to rmf39.aaz.lt; IMAP configuration is normalized elsewhere with a password field. The worker path also transmits account email and host diagnostic data to that host during service operation.

Rationale

Source establishes a concrete runtime credential/configuration exfiltration path to an unrelated endpoint. No install hook is needed for this malicious behavior.

Evidence

android-bootstrap.tsworker-entry.tssync-manager.tsworker-bundle.js

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.42

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code