postboi@0.49.0
<div align="center"> <img src="https://raw.githubusercontent.com/postboi-mail/postboi/refs/heads/main/static/logo.svg" alt="Postboi" width="250" />
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package does not execute its CLI during npm installation, so the evidence does not establish malicious install-hook abuse. Its bundled AI-agent instructions and automatic agent-mode mutations nevertheless create a concrete dangerous capability requiring a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user or coding agent runs postboi init --agent, postboi skill, or a credential-sync command.
Impact
A coding agent can be induced to alter project configuration and place credentials with the package vendor without an interactive human confirmation.
Mechanism
Agent-directed project mutation and credential synchronization.
AI rationale
The package does not execute its CLI during npm installation, so the evidence does not establish malicious install-hook abuse. Its bundled AI-agent instructions and automatic agent-mode mutations nevertheless create a concrete dangerous capability requiring a warning.
Evidence
skills/postboi/SKILL.mddist/cli.js.env.gitignore.claude/skills/postboi/SKILL.mdpackage.json
Network endpoints1
postboi.app
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The bundled agent skill tells coding agents to run an initialization command that can operate without a human.
- The agent mode accepts default confirmations, provisions a remote account, writes a token locally, and installs an agent skill.
- The CLI creates or replaces a project-local Claude skill, including a symlink that tracks the installed package.
- The CLI can upload collected non-Postboi provider credentials to the Postboi API.
Evidence against
- The manifest has only a prepare hook for SvelteKit synchronization; it does not run the CLI on registry installation.
- The risky filesystem and network behavior is reached through explicit CLI commands, not import-time code.
- The Microsoft 365 code sends supplied credentials only to Microsoft OAuth and Graph endpoints for its stated mail-provider function.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggeddist/cli.jsView file
47// src/library/encoding.ts
L48: function base64_decode(value) {
L49: const binary = atob(value);
...
L131: const { pathToFileURL } = await import("node:url");
L132: let dir = process.cwd();
L133: for (;; ) {
...
L276: if (this.#hooks.before?.send) {
L277: return this.#hooks.before.send({
L278: provider: this.provider,
...
L325: async send_request(url, init) {
L326: return fetch(url, init);
L327: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4747// src/library/encoding.ts
L48: function base64_decode(value) {
L49: const binary = atob(value);
...
L131: const { pathToFileURL } = await import("node:url");
L132: let dir = process.cwd();
L133: for (;; ) {
...
L276: if (this.#hooks.before?.send) {
L277: return this.#hooks.before.send({
L278: provider: this.provider,
...
L325: async send_request(url, init) {
L326: return fetch(url, init);
L327: }
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L47•matchType = previous_version_dangerous_delta
matchedPackage = postboi@0.43.0
matchedIdentity = npm:cG9zdGJvaQ:0.43.0
similarity = 0.425
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.49.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.49.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.