registry / @bobfrankston/mailx-store-web / 0.1.62

@bobfrankston/mailx-store-web@0.1.62

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Runtime Android initialization silently sends account configuration to an unrelated logging endpoint. IMAP configuration can include the account password.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User invokes initAndroid() and cloud account reconciliation loads configured accounts.

Impact

Disclosure of IMAP credentials, email addresses, account IDs, and mail-server details.

Mechanism

silent URL-path exfiltration through verbose logging

Attack narrative

During Android initialization, each Google Drive-loaded account is passed to vlog with JSON.stringify(account.imap). That object contains the configured IMAP password. vlog URL-encodes the message into a request to rmf39.aaz.lt/logit with silent=true and suppresses failures, sending credentials without user disclosure or a package-aligned service requirement.

Rationale

Source directly establishes a runtime credential-exfiltration path to rmf39.aaz.lt. The lack of install hooks does not mitigate this user-runtime attack.

Evidence

android-bootstrap.tssync-manager.tsworker-entry.tsworker-bundle.jspackage.jsonmain-thread-host.ts

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.62

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code