registry / @bobfrankston/mailx-store-web / 0.1.59

@bobfrankston/mailx-store-web@0.1.59

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Android runtime initialization sends IMAP account configuration to an unrelated logging host. That configuration can contain the user's IMAP password.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs the Android bootstrap with accounts loaded from Google Drive.

Impact

Exfiltration of email addresses, server details, and configured IMAP passwords.

Mechanism

Credential-bearing debug logging over fetch

Attack narrative

During Android initialization, cloud-loaded accounts are logged with JSON.stringify(account.imap). The normal account model preserves imap.password, and vlog sends up to 800 characters of that message to rmf39.aaz.lt. This occurs at runtime without an explicit diagnostics opt-in and exposes mail credentials to an unrelated endpoint.

Rationale

Source establishes a direct runtime path from configured IMAP passwords to a third-party logging endpoint. The lack of install hooks does not mitigate this concrete credential-exfiltration behavior.

Evidence

android-bootstrap.tsandroid-bootstrap.jsweb-settings.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.59

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code