postboi@0.51.0
<div align="center"> <img src="https://raw.githubusercontent.com/postboi-mail/postboi/refs/heads/main/static/logo.svg" alt="Postboi" width="250" />
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe only agent-control writes are first-party skill files created by the explicit postboi init command, and --agent accepts the default yes without a second prompt. That is user-invoked package setup, not an install-hook hijack or hidden exfiltration, so it warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User or agent runs the postboi CLI init command (postboi init or postboi init --agent).
Impact
A coding agent in that project is steered to follow the postboi skill. No secret theft, remote payload, or install-time mutation was found.
Mechanism
offer_skill confirms (default yes; --agent auto-accepts), then install_skill and place_companions symlink or copy the bundled skill and may append AGENTS.md.
AI rationale
The only agent-control writes are first-party skill files created by the explicit postboi init command, and --agent accepts the default yes without a second prompt. That is user-invoked package setup, not an install-hook hijack or hidden exfiltration, so it warrants a warning rather than a publish block.
Evidence
dist/cli.js.claude/skills/postboi/SKILL.md.agents/skills/postboi/SKILL.mdAGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- postboi init calls offer_skill, which installs the bundled skill at .claude/skills/postboi/SKILL.md when confirm succeeds, and confirm defaults to yes.
- The --agent prompt helper sets agent:true and confirm() returns its fallback (true), so init --agent installs the skill without a typed yes.
- place_companions also installs .agents/skills/postboi/SKILL.md and appends an AGENTS.md pointer when that file exists and does not already mention postboi.
- Those writes run only from the postboi CLI init path, which package.json exposes as the postboi bin.
Evidence against
- package.json has no preinstall, install, or postinstall hook; prepare only runs svelte-kit sync.
- Interactive confirm prints a Y/n question before a new skill install.
- The files written are this package's own skill and a pointer to it, not a foreign agent control file.
- CLI network calls use the Postboi product host (postboi.app or POSTBOI_API_URL) for account setup, not a hidden recipient.
Behavioral surface
ChildProcessCrypto
Source & flagged code
7 flaggeddist/cli.jsView file
41// src/library/encoding.ts
L42: function base64_decode(value) {
L43: const binary = atob(value);
...
L125: const { pathToFileURL } = await import("node:url");
L126: let dir = process.cwd();
L127: for (;; ) {
...
L270: if (this.#hooks.before?.send) {
L271: return this.#hooks.before.send({
L272: provider: this.provider,
...
L319: async send_request(url, init) {
L320: return fetch(url, init);
L321: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4141// src/library/encoding.ts
L42: function base64_decode(value) {
L43: const binary = atob(value);
...
L125: const { pathToFileURL } = await import("node:url");
L126: let dir = process.cwd();
L127: for (;; ) {
...
L270: if (this.#hooks.before?.send) {
L271: return this.#hooks.before.send({
L272: provider: this.provider,
...
L319: async send_request(url, init) {
L320: return fetch(url, init);
L321: }
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L41•matchType = previous_version_dangerous_delta
matchedPackage = postboi@0.49.0
matchedIdentity = npm:cG9zdGJvaQ:0.49.0
similarity = 0.958
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.51.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.51.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.