registry / @bobfrankston/mailx-store-web / 0.1.79

@bobfrankston/mailx-store-web@0.1.79

AI Security Review

scanned 3d ago · by lpm-firewall-ai

At Android runtime, cloud-loaded account configuration is logged to a third-party host. IMAP configuration can contain a password.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Running the Android bootstrap with one or more cloud-loaded accounts.

Impact

IMAP credentials and account metadata may be exfiltrated.

Mechanism

Serializes account.imap into remote verbose-log requests.

Attack narrative

The Android bootstrap loads accounts from cloud storage, then logs JSON.stringify(account.imap) through vlog. vlog sends up to 800 characters in a fetch URL to rmf39.aaz.lt. Because the IMAP configuration is used elsewhere with account.imap.password, this remote request can disclose a configured mailbox password without a user action specific to logging.

Rationale

This is concrete credential exfiltration in a normal runtime initialization path, despite no install-time lifecycle hook. The scanner similarity is unnecessary to the verdict.

Evidence

android-bootstrap.tspackage.jsonindex.tsaccounts.jsonc

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

@bobfrankston/mailx-store-web@0.1.79

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code