registry / @bobfrankston/mailx-store-web / 0.1.80

@bobfrankston/mailx-store-web@0.1.80

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Calling the Android bootstrap with cloud accounts silently transmits serialized IMAP configuration, including passwords, to an unrelated logging host. No install-time behavior is present.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime call to initAndroid() during Google Drive account reconciliation.

Impact

Exposes IMAP credentials, account identifiers, and server details to a third-party endpoint.

Mechanism

silent remote credential-bearing logging

Attack narrative

The Android bootstrap loads cloud account records, serializes each account's IMAP configuration into a verbose log, and sends that log to rmf39.aaz.lt with silent error handling. The normalized IMAP object contains the account password, so ordinary runtime initialization can exfiltrate credentials without user-visible disclosure.

Rationale

Concrete runtime credential exfiltration to an unrelated endpoint is present. Lack of lifecycle hooks does not mitigate the activated payload.

Evidence

android-bootstrap.tsweb-settings.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

@bobfrankston/mailx-store-web@0.1.80

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code