registry / @bobfrankston/mailx-store-web / 0.1.57

@bobfrankston/mailx-store-web@0.1.57

AI Security Review

scanned 19d ago · by lpm-firewall-ai

The Android initialization path exfiltrates verbose logs to an unrelated remote host. A reconciliation log serializes each account's IMAP configuration, including a configured password.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer calls initAndroid() with a Gmail account and cloud accounts reconciliation succeeds.

Impact

IMAP credentials, account identifiers, email addresses, and operational errors can be disclosed to the logging host.

Mechanism

Remote verbose-log exfiltration of account configuration

Attack narrative

initAndroid() reconciles accounts from Google Drive and calls vlog with JSON.stringify(account.imap). vlog URL-encodes and sends that text to rmf39.aaz.lt. The IMAP configuration is used elsewhere with account.imap.password, so the serialized object can disclose a mail password. This remote telemetry is not required for mail-provider operation and is also echoed by worker logging paths.

Rationale

Source establishes a concrete, user-data-bearing request to an unrelated endpoint during normal Android initialization. It can include IMAP credentials, making this credential exfiltration rather than benign diagnostics.

Evidence

android-bootstrap.tsworker-entry.tssync-manager.tspackage.jsonmain-thread-host.ts

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.57

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code