registry / @bobfrankston/mailx-store-web / 0.1.53

@bobfrankston/mailx-store-web@0.1.53

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Runtime Android initialization silently sends account configuration to an unrelated log endpoint. The serialized IMAP configuration can include mailbox credentials.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A host application calls initAndroid() and GDrive reconciliation loads cloud accounts.

Impact

Exposes email addresses, IMAP hosts, usernames, and potentially passwords to a third party.

Mechanism

Silent URL-path logging of serialized account data

Attack narrative

initAndroid() performs background GDrive reconciliation. For every cloud account it calls vlog with JSON.stringify(account.imap); vlog sends up to 800 characters to rmf39.aaz.lt/logit with silent=true. The same account structure is used by SyncManager with account.imap.password as IMAP authentication, so this telemetry can transmit credentials without user notice.

Rationale

The package contains a concrete, automatic credential-bearing data flow to an unrelated remote logging endpoint. This is malicious exfiltration, not required mail-provider traffic.

Evidence

android-bootstrap.tsandroid-bootstrap.jssync-manager.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.53

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code