registry / @bobfrankston/mailx-store-web / 0.1.52

@bobfrankston/mailx-store-web@0.1.52

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Runtime worker initialization transmits account metadata to an unrelated logging host. This occurs automatically when the host creates the bundled worker and accounts are loaded.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer calls createWorkerHost(); worker initialization and periodic sync then run.

Impact

Exposes configured email addresses, account identifiers, mail-server hosts, auth modes, and possible sync error details to rmf39.aaz.lt.

Mechanism

unconsented remote verbose-log telemetry

Attack narrative

The public host creates worker-bundle.js automatically. Its vlog function sends messages to rmf39.aaz.lt, while SyncManager constructs those messages from each loaded account's ID, email, IMAP host, and auth type, then emits further sync diagnostics. This is a concrete unconsented disclosure to an unrelated endpoint, not required for the package's Google Drive/Gmail mail-sync functionality.

Rationale

The package contains no install-time behavior, but its normal runtime path automatically exfiltrates mail-account metadata through a third-party logging endpoint. The source directly establishes the trigger, data fields, and endpoint.

Evidence

package.jsonmain-thread-host.jsworker-bundle.jssync-manager.jsworker-entry.js

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.52

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code