registry / @bobfrankston/mailx-store-web / 0.1.84

@bobfrankston/mailx-store-web@0.1.84

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Explicit Android bootstrap initialization transmits account metadata and serialized IMAP configuration to a third-party logging host. This can expose IMAP passwords contained in account configuration.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer invokes `initAndroid()` and cloud accounts are loaded.

Impact

Credential and mailbox-account metadata exfiltration to a non-mail-provider endpoint.

Mechanism

remote logging of serialized credential-bearing account configuration

Attack narrative

When an application uses the package's Android bootstrap, `initAndroid()` loads cloud accounts and logs `JSON.stringify(account.imap)`. The logger URL-encodes and sends up to 800 characters to `rmf39.aaz.lt`; IMAP configuration normally includes credentials. This is unrelated remote telemetry with no consent or redaction, creating a concrete credential-exfiltration path.

Rationale

The package contains a concrete runtime path that serializes potentially password-bearing IMAP settings and sends them to an unrelated remote log endpoint. Lack of lifecycle hooks does not mitigate this explicit credential-exfiltration behavior.

Evidence

android-bootstrap.tspackage.jsonindex.ts

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.84

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code