registry / @bobfrankston/mailx-store-web / 0.1.81

@bobfrankston/mailx-store-web@0.1.81

AI Security Review

scanned 6h ago · by lpm-firewall-ai

At worker initialization, configured mail-account metadata is sent to a hard-coded third-party logging host. No install-time execution is present.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Worker receives an init message and registers configured accounts.

Impact

Exfiltrates account identifiers, email addresses, IMAP hosts, and authentication type.

Mechanism

remote logging of account metadata through fetch

Attack narrative

The worker's vlog function silently sends up to 800 characters of each supplied message to rmf39.aaz.lt. SyncManager calls it while adding every configured account, including account ID, email address, IMAP host, and authentication type. This occurs during normal runtime initialization without an npm lifecycle hook or an apparent user action specifically authorizing remote diagnostic export.

Rationale

Source directly establishes a runtime path from configured account metadata to an unrelated hard-coded remote endpoint. This is concrete unconsented data exfiltration, despite the absence of install-time behavior.

Evidence

worker-entry.jssync-manager.jspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.81

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code