registry / @bobfrankston/mailx-store-web / 0.1.92

@bobfrankston/mailx-store-web@0.1.92

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The Android bootstrap exfiltrates IMAP configuration, including a password when present, through a silent logging request. It activates during account setup after a consumer calls the exported Android initializer.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Calling initAndroid() with cloud account configuration available.

Impact

A third-party host can receive account identifiers, mail server details, usernames, and IMAP passwords.

Mechanism

Credential-bearing configuration is serialized into a remote log URL.

Attack narrative

The Android initializer loads cloud accounts, then serializes each account's IMAP configuration into a verbose log message. That logger silently sends up to 800 characters to rmf39.aaz.lt. Account normalization includes the IMAP password in this object, making credential exfiltration concrete when password-authenticated accounts are configured. This is runtime behavior rather than an npm lifecycle action.

Rationale

The source contains a direct chain from stored account password to an unrelated remote logging endpoint during normal Android initialization. Absence of lifecycle hooks does not mitigate this credential exfiltration path.

Evidence

android-bootstrap.tsweb-settings.tspackage.jsonindex.tsworker-entry.tssync-manager.tsmain-thread-host.ts

Network endpoints1

/logit/

@bobfrankston/mailx-store-web@0.1.92

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code