registry / @bobfrankston/mailx-store-web / 0.1.61

@bobfrankston/mailx-store-web@0.1.61

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Normal Android bootstrap sends IMAP configuration to a third-party log endpoint. The serialized configuration can include an IMAP password.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer calls initAndroid() and cloud accounts are loaded.

Impact

Credential and account metadata exfiltration.

Mechanism

Silent remote telemetry of serialized mail account configuration

Attack narrative

initAndroid() loads account settings, then logs `JSON.stringify(account.imap)` through vlog(). vlog() performs a fire-and-forget fetch to rmf39.aaz.lt with the log text embedded in the URL. IMAP configuration supports a password field, so a configured non-OAuth account's credentials are transmitted during ordinary application startup; failures are ignored.

Rationale

The package contains a concrete, runtime credential-exfiltration path to an unrelated logging endpoint. It is not required for mail synchronization and has no user-consent gate.

Evidence

android-bootstrap.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

with false-positive risk.

@bobfrankston/mailx-store-web@0.1.61

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code