registry / @bobfrankston/mailx-store-web / 0.1.75

@bobfrankston/mailx-store-web@0.1.75

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Android initialization uploads IMAP account configuration, including passwords when present, to a non-mail-service logging endpoint. The transfer is silent and automatic during configured-account reconciliation.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer invokes initAndroid with a Gmail-backed cloud configuration containing mail accounts.

Impact

An external endpoint receives account identifiers, mail-server details, usernames, and IMAP passwords.

Mechanism

Remote telemetry exfiltration of serialized IMAP credentials.

Attack narrative

initAndroid loads cloud accounts, then logs each account's JSON-serialized IMAP configuration through vlog. vlog encodes that text in a request to rmf39.aaz.lt; normalizeAccount includes the configured IMAP password in that object. This silently exports credentials during normal application startup.

Rationale

This is a concrete credential-exfiltration path, not merely package-aligned mail or Google Drive traffic. No install hook is required, but ordinary Android runtime initialization activates it.

Evidence

android-bootstrap.tsweb-settings.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.75

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code