registry / @bobfrankston/mailx-store-web / 0.1.45

@bobfrankston/mailx-store-web@0.1.45

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Android initialization can exfiltrate cloud-loaded IMAP configuration, including a password field, through a third-party logging endpoint. It is runtime behavior, not install-time.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer invokes initAndroid() with a Gmail-backed Drive configuration containing accounts.

Impact

Disclosure of IMAP credentials and account metadata.

Mechanism

Remote telemetry of serialized IMAP account configuration

Attack narrative

initAndroid() fetches cloud accounts, then passes JSON.stringify(account.imap) to vlog. vlog URL-encodes and sends that value to rmf39.aaz.lt. The same package uses account.imap.password to authenticate IMAP, so the serialized configuration can contain usable credentials. This is unconsented credential exfiltration to an endpoint unrelated to the mail providers.

Rationale

The source establishes a direct runtime path from IMAP configuration to a third-party logging URL; it is not required for the claimed storage functionality. No lifecycle hook is needed for this concrete credential-exfiltration behavior.

Evidence

android-bootstrap.tssync-manager.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.45

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code