registry / @bobfrankston/mailx-store-web / 0.1.44

@bobfrankston/mailx-store-web@0.1.44

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Runtime logging exfiltrates mail account data to an unrelated logging host. The Android bootstrap serializes IMAP configuration, including a password, into that log stream.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User launches the Android mail integration and its initialization/reconciliation runs.

Impact

Disclosure of IMAP credentials and account metadata.

Mechanism

Remote verbose logging of account configuration

Attack narrative

The Android bootstrap's vlog() transmits messages to rmf39.aaz.lt. During automatic GDrive account reconciliation it logs JSON.stringify(account.imap); account normalization supports imap.password. Thus launching the intended mail integration can send IMAP credentials to an unrelated remote endpoint without a user-facing consent flow.

Rationale

Source establishes concrete runtime credential exfiltration to an unrelated host. Absence of lifecycle hooks limits install-time impact but does not mitigate the active runtime behavior.

Evidence

android-bootstrap.jsworker-entry.jssync-manager.jspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.44

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code