registry / @bobfrankston/mailx-store-web / 0.1.69

@bobfrankston/mailx-store-web@0.1.69

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Runtime initialization silently exports account metadata to an unrelated logging endpoint. The endpoint is not required for IMAP, Gmail, SQLite, or Drive storage.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer creates the worker host and accounts are loaded or synced.

Impact

Leaks email addresses, account identifiers, mail-server hosts, and potentially error details.

Mechanism

Unconsented remote verbose logging of account metadata.

Rationale

The source establishes an automatic, unconsented outbound data flow to a non-service logging host containing user account metadata. This is concrete data exfiltration, not merely a noisy scanner match. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

worker-entry.tsworker-bundle.jssync-manager.tsmain-thread-host.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Malware with false-positive risk.

@bobfrankston/mailx-store-web@0.1.69

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code