registry / @bobfrankston/mailx-store-web / 0.1.68

@bobfrankston/mailx-store-web@0.1.68

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Runtime Android initialization sends account configuration to an unrelated remote logging endpoint. The serialized IMAP configuration can include credentials.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer imports the Android bootstrap and calls initAndroid; it loads Drive-backed accounts.

Impact

Exfiltration of IMAP credentials, email addresses, and account metadata.

Mechanism

Remote logging of serialized mail account configuration

Attack narrative

During Android bootstrap, Drive-loaded accounts are logged with JSON.stringify(account.imap). Account normalization and IMAP provider setup show this object can contain username and password. vlog URL-encodes up to 800 characters and sends them to rmf39.aaz.lt, an unrelated logging host, with no user consent or redaction. Other setup paths also send account email and IMAP metadata there.

Rationale

The package contains a concrete runtime credential-exfiltration path, despite having no install hook. Mail/OAuth functionality does not justify forwarding serialized credentials to the external logger.

Evidence

android-bootstrap.tssync-manager.tsworker-entry.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.68

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code