postboi@0.37.1
<div align="center"> <img src="https://raw.githubusercontent.com/postboi-mail/postboi/refs/heads/main/static/logo.svg" alt="Postboi" width="250" />
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner's credential and process findings map to documented CLI setup/synchronization behavior, not covert execution. The shipped lifecycle hook is non-networked `prepare`, and risky operations require explicit user commands and authentication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `postboi init`, `postboi sync`, or `postboi env push`.
Impact
Selected provider credentials may be uploaded to the user's Postboi account as an advertised CLI feature.
Mechanism
Authenticated, user-invoked credential synchronization and optional package skill setup.
AI rationale
The scanner's credential and process findings map to documented CLI setup/synchronization behavior, not covert execution. The shipped lifecycle hook is non-networked `prepare`, and risky operations require explicit user commands and authentication.
Evidence
package.jsondist/cli.jsdist/workers_env.jsskills/postboi/SKILL.md.env.env.local.envrc.claude/skills/postboi/SKILL.md
Network endpoints1
postboi.app/v1/env
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The explicit `postboi env push` command can upload selected project provider credentials to the authenticated Postboi API.
- The CLI can write a bundled Postboi skill under `.claude/skills` during explicit setup.
Evidence against
- The only lifecycle hook is `prepare`, which runs `svelte-kit sync`; there is no install/postinstall hook.
- Credential upload is an explicit CLI action and requires `POSTBOI_TOKEN`; it is described as syncing to the user's Postboi account.
- Skill installation is prompted during setup, and the written skill is package-owned rather than a broad agent-control mutation.
- No browser credential harvesting, stealth execution, arbitrary remote payload loading, or unconsented exfiltration was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
6 flaggeddist/cli.jsView file
108const { pathToFileURL } = await import("node:url");
L109: let dir = process.cwd();
L110: for (;; ) {
...
L245: if (this.#hooks.before?.send) {
L246: return this.#hooks.before.send({
L247: provider: this.provider,
...
L294: async send_request(url, init) {
L295: return fetch(url, init);
L296: }
...
L358: async read_json(response) {
L359: const text = await response.text();
L360: if (!text)
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L108108const { pathToFileURL } = await import("node:url");
L109: let dir = process.cwd();
L110: for (;; ) {
...
L245: if (this.#hooks.before?.send) {
L246: return this.#hooks.before.send({
L247: provider: this.provider,
...
L294: async send_request(url, init) {
L295: return fetch(url, init);
L296: }
...
L358: async read_json(response) {
L359: const text = await response.text();
L360: if (!text)
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L108788} from "node:fs";
L789: import { spawnSync } from "node:child_process";
L790: import { join as join5, delimiter, dirname as dirname3 } from "node:path";
High
Findings
2 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.37.1.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.37.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.