postboi@0.42.0
<div align="center"> <img src="https://raw.githubusercontent.com/postboi-mail/postboi/refs/heads/main/static/logo.svg" alt="Postboi" width="250" />
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo automatic malicious install chain or hidden exfiltration was found. The package nevertheless provides an explicit, persistent agent extension that can drive non-interactive project and credential setup.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running postboi skill or postboi init --agent in a project.
Impact
An agent can be guided to modify project configuration and create credentials without a human prompt.
Mechanism
First-party agent-skill installation and non-interactive account setup.
AI rationale
No automatic malicious install chain or hidden exfiltration was found. The package nevertheless provides an explicit, persistent agent extension that can drive non-interactive project and credential setup.
Evidence
dist/cli.jsskills/postboi/SKILL.md.claude/skills/postboi/SKILL.md.envpostboi.config.ts
Network endpoints1
postboi.app
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI creates a Postboi skill under the project's Claude agent-skill directory.
- The bundled skill instructs coding agents to run a non-interactive setup that writes secrets and provisions an account.
- The CLI routes this behavior through explicit postboi commands, but agent-mode setup can be non-interactive.
Evidence against
- The only lifecycle hook is prepare, which runs a Svelte synchronization command and does not invoke the CLI.
- The skill installation path is first-party and package-scoped, not a broad agent configuration write.
- Credential uploads require the explicit env push action and a Postboi token.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
47// src/library/encoding.ts
L48: function base64_decode(value) {
L49: const binary = atob(value);
...
L131: const { pathToFileURL } = await import("node:url");
L132: let dir = process.cwd();
L133: for (;; ) {
...
L268: if (this.#hooks.before?.send) {
L269: return this.#hooks.before.send({
L270: provider: this.provider,
...
L317: async send_request(url, init) {
L318: return fetch(url, init);
L319: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4747// src/library/encoding.ts
L48: function base64_decode(value) {
L49: const binary = atob(value);
...
L131: const { pathToFileURL } = await import("node:url");
L132: let dir = process.cwd();
L133: for (;; ) {
...
L268: if (this.#hooks.before?.send) {
L269: return this.#hooks.before.send({
L270: provider: this.provider,
...
L317: async send_request(url, init) {
L318: return fetch(url, init);
L319: }
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L47792} from "node:fs";
L793: import { spawnSync } from "node:child_process";
L794: import { join as join6, delimiter, dirname as dirname3 } from "node:path";
Findings
2 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.42.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.42.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.