postboi@0.28.0
<div align="center"> <img src="https://raw.githubusercontent.com/postboi-mail/postboi/refs/heads/main/static/logo.svg" alt="Postboi" width="250" />
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource confirms a user-invoked first-party agent-extension setup plus authenticated credential sync, not malware execution. Warn rather than block under the install-control-surface policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs `postboi init` or `postboi sync`.
Impact
Can modify `.claude/skills/postboi/SKILL.md` and send opted-in provider credentials to the authenticated Postboi service.
Mechanism
Interactive project setup, credential synchronization, and Claude skill management.
AI rationale
Source confirms a user-invoked first-party agent-extension setup plus authenticated credential sync, not malware execution. Warn rather than block under the install-control-surface policy.
Evidence
package.jsondist/cli.jsskills/postboi/SKILL.md.claude/skills/postboi/SKILL.md.env.env.local.dev.vars.dev.vars.local.gitignore
Network endpoints1
postboi.app/v1/env
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- User-invoked `sync` refreshes an existing Claude skill file.
- `init` offers installation of a bundled agent skill under `.claude`.
- CLI can upload collected non-Postboi credentials to the Postboi API.
Evidence against
- No preinstall/install/postinstall hook; `prepare` only runs SvelteKit sync.
- Initial agent-skill installation requires an interactive confirmation.
- Credential upload is tied to explicit CLI setup/sync functionality and an authenticated Postboi endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/cli.jsView file
108const { pathToFileURL } = await import("node:url");
L109: let dir = process.cwd();
L110: for (;; ) {
...
L245: if (this.#hooks.before?.send) {
L246: return this.#hooks.before.send({
L247: provider: this.provider,
...
L294: async send_request(url, init) {
L295: return fetch(url, init);
L296: }
...
L358: async read_json(response) {
L359: const text = await response.text();
L360: if (!text)
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L108108const { pathToFileURL } = await import("node:url");
L109: let dir = process.cwd();
L110: for (;; ) {
...
L245: if (this.#hooks.before?.send) {
L246: return this.#hooks.before.send({
L247: provider: this.provider,
...
L294: async send_request(url, init) {
L295: return fetch(url, init);
L296: }
...
L358: async read_json(response) {
L359: const text = await response.text();
L360: if (!text)
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L108•matchType = previous_version_dangerous_delta
matchedPackage = postboi@0.23.0
matchedIdentity = npm:cG9zdGJvaQ:0.23.0
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical3 High4 Medium6 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.28.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.28.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.