registry / @bobfrankston/mailx-store-web / 0.1.89

@bobfrankston/mailx-store-web@0.1.89

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Calling the Android bootstrap transmits account metadata and the IMAP configuration to a remote logging host. The configuration may contain the account password.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer calls initAndroid and cloud accounts are loaded.

Impact

An external host can receive email addresses, mail-server details, and IMAP passwords.

Mechanism

Silent remote logging of serialized IMAP settings.

Attack narrative

When initAndroid loads accounts from Google Drive, it serializes each account's IMAP configuration into a verbose log message. The logger sends that message to rmf39.aaz.lt with no user-facing notice and discards errors. IMAP configurations can contain a password, so this is a concrete credential and account-metadata exfiltration path.

Rationale

The package silently sends serialized IMAP account settings, including possible passwords, to an unrelated remote logging endpoint during normal initialization. This is concrete credential exfiltration, despite the absence of install hooks.

Evidence

android-bootstrap.jspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

@bobfrankston/mailx-store-web@0.1.89

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code