postboi
Postboi is an email provider and TypeScript SDK. Send email with one token and no DNS setup, plus SMS, WhatsApp, push and chat from the same API. You can also use your own provider (Resend, SES, Postmark and more) if you want to.
This report shows the evidence for postboi@0.74.0. 1 of 58 known versions is blocked or flagged. The newest version, 0.77.0, is allowed. See all versions.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe init flow forwards external provider secrets to the package’s default API whenever a Postboi token exists, with no recipient-specific consent gate. This is confirmed credential exfiltration, so publication should be blocked.
Decision evidence
public snapshot- package.json exposes dist/cli.js as the postboi command.
- The init flow collects external provider credentials, retaining secret fields for persistence.
- Credential persistence automatically calls the team sync function without an intervening consent prompt.
- The sync sends changed non-Postboi values when POSTBOI_TOKEN is present.
- The uploader sends those values to /v1/env with bearer authentication; the default API host is postboi.app.
Source & flagged code
6 flaggedSource appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L69Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L69Package source references child process execution.
Findings
Affected versions and remediation
This report applies to postboi@0.74.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing postboi@0.74.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.