postboi@0.41.0
<div align="center"> <img src="https://raw.githubusercontent.com/postboi-mail/postboi/refs/heads/main/static/logo.svg" alt="Postboi" width="250" />
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes a user-triggered consumer lifecycle mutation with follow-on credential and agent-skill effects. It does not establish unconsented behavior at package installation, so a warning is more proportionate than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs postboi init, then a later package lifecycle runs the added prepare command.
Impact
Future installs can modify project env files and an existing agent skill without another interactive prompt.
Mechanism
Consumer lifecycle injection followed by credential synchronization and agent-skill refresh.
AI rationale
The source establishes a user-triggered consumer lifecycle mutation with follow-on credential and agent-skill effects. It does not establish unconsented behavior at package installation, so a warning is more proportionate than a block.
Evidence
package.jsondist/cli.js.claude/skills/postboi/SKILL.md.env.env.local.dev.vars.dev.vars.local
Network endpoints1
postboi.app/v1/env
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit init flow adds a consumer prepare lifecycle command that runs postboi sync on future installs.
- The sync command automatically refreshes an existing Claude skill file.
- The env push command collects configured provider credential variables from local project env files and sends them to the Postboi API.
- The package's own install hook is only a build preparation command, so the risky lifecycle is introduced by the user-invoked CLI rather than package installation.
Evidence against
- No preinstall, install, or postinstall script is declared.
- Credential transfer uses the package's configured Postboi service and requires an explicit CLI command or init flow.
- The Cloudflare dynamic import is guarded to the Cloudflare Workers runtime.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggeddist/cli.jsView file
47// src/library/encoding.ts
L48: function base64_decode(value) {
L49: const binary = atob(value);
...
L131: const { pathToFileURL } = await import("node:url");
L132: let dir = process.cwd();
L133: for (;; ) {
...
L268: if (this.#hooks.before?.send) {
L269: return this.#hooks.before.send({
L270: provider: this.provider,
...
L317: async send_request(url, init) {
L318: return fetch(url, init);
L319: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4747// src/library/encoding.ts
L48: function base64_decode(value) {
L49: const binary = atob(value);
...
L131: const { pathToFileURL } = await import("node:url");
L132: let dir = process.cwd();
L133: for (;; ) {
...
L268: if (this.#hooks.before?.send) {
L269: return this.#hooks.before.send({
L270: provider: this.provider,
...
L317: async send_request(url, init) {
L318: return fetch(url, init);
L319: }
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L47•matchType = previous_version_dangerous_delta
matchedPackage = postboi@0.39.0
matchedIdentity = npm:cG9zdGJvaQ:0.39.0
similarity = 0.670
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.41.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.41.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.