postboi@0.24.0
⚠ Under review<div align="center"> <img src="https://raw.githubusercontent.com/postboi-mail/postboi/refs/heads/main/static/logo.svg" alt="Postboi" width="250" />
Static Scan Results
scanned 3mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/cli.jsView file
6import { readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync4, existsSync as existsSync3, appendFileSync } from "node:fs";
L7: import { spawnSync } from "node:child_process";
L8: import { join as join4, delimiter } from "node:path";
...
L17: class: "Resend",
L18: url: "https://resend.com/api-keys",
L19: fields: [
...
L293: { env: "MJ_APIKEY_PUBLIC", arg: "api_key", label: "API key", secret: true },
L294: { env: "MJ_APIKEY_PRIVATE", arg: "api_secret", label: "Secret key", secret: true },
L295: {
...
L458: },
L459: { env: "VAPID_PRIVATE_KEY", arg: "private_key", label: "VAPID private key", secret: true },
L460: {
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L66Trigger-reachable chain: manifest.bin -> dist/cli.js
L6: import { readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync4, existsSync as existsSync3, appendFileSync } from "node:fs";
L7: import { spawnSync } from "node:child_process";
L8: import { join as join4, delimiter } from "node:path";
...
L17: class: "Resend",
L18: url: "https://resend.com/api-keys",
L19: fields: [
...
L293: { env: "MJ_APIKEY_PUBLIC", arg: "api_key", label: "API key", secret: true },
L294: { env: "MJ_APIKEY_PRIVATE", arg: "api_secret", label: "Secret key", secret: true },
L295: {
...
L458: },
L459: { env: "VAPID_PRIVATE_KEY", arg: "private_key", label: "VAPID private key", secret: true },
L460: {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
3 Critical3 High4 Medium6 Low
CriticalBrowser Credential Phishingdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to postboi@0.24.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.