registry / @bobfrankston/mailx-store-web / 0.1.93

@bobfrankston/mailx-store-web@0.1.93

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At Android runtime, account setup transmits serialized IMAP settings to a remote logging host. Those settings can include the user's email address, IMAP username, host, and password.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Initializing the Android/WebView mail service with Google Drive accounts.

Impact

IMAP credentials and account metadata may be exfiltrated to rmf39.aaz.lt.

Mechanism

Remote verbose logging of serialized account configuration.

Attack narrative

The package initializes mail accounts from Google Drive, serializes each account's IMAP configuration into a verbose log message, and sends that message to rmf39.aaz.lt. Its configuration builder includes the IMAP password in that serialized object. This creates a direct runtime credential-exfiltration path without an install hook.

Rationale

Source establishes a direct path from account credentials to a third-party logging endpoint during ordinary initialization. This is concrete credential exfiltration, not required mail-storage functionality.

Evidence

android-bootstrap.tsweb-settings.tspackage.json

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

@bobfrankston/mailx-store-web@0.1.93

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code