registry / @bobfrankston/mailx-store-web / 0.1.87

@bobfrankston/mailx-store-web@0.1.87

AI Security Review

scanned 9h ago · by lpm-firewall-ai

At runtime, account metadata is transmitted as URL-path telemetry to an unrelated endpoint. This includes users' email addresses and mail-server details.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A host application calls the package's Android/worker initialization and accounts are loaded.

Impact

Unconsented disclosure of mailbox-identifying information and operational error details.

Mechanism

Remote verbose logging of account metadata.

Attack narrative

The package defines a remote logger targeting rmf39.aaz.lt and passes it into account setup. Account initialization constructs telemetry containing an account ID, email address, IMAP host, and authentication type; the logger URL-encodes and sends it remotely. This occurs during normal application initialization, not package installation, and is unrelated to the required IMAP/SMTP or Google API operations.

Rationale

Source establishes a concrete runtime data-exfiltration path for personal mailbox metadata to an unrelated endpoint. The absence of lifecycle hooks does not mitigate this runtime behavior.

Evidence

android-bootstrap.tssync-manager.tsworker-entry.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

@bobfrankston/mailx-store-web@0.1.87

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code