postboi@0.55.0
Postboi is an email provider and TypeScript SDK. Send email with one token and no DNS setup, plus SMS, WhatsApp, push and chat from the same API. You can also use your own provider (Resend, SES, Postmark and more) if you want to.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package contains a real, project-scoped AI-agent configuration capability with consent and subsequent automatic refresh behavior. That warrants a warning under the agent-extension policy, but the inspected code does not establish malicious intent or a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the Postboi setup or skill command; initial setup requires confirmation for a missing skill.
Impact
A consenting project can have AI-agent guidance files updated on later CLI setup runs; no secret export or arbitrary remote execution was established.
Mechanism
The CLI writes or links package-provided skill material and can refresh an existing target and companion agent files.
AI rationale
The package contains a real, project-scoped AI-agent configuration capability with consent and subsequent automatic refresh behavior. That warrants a warning under the agent-extension policy, but the inspected code does not establish malicious intent or a concrete attack.
Evidence
dist/cli.js.claude/skills/postboi/SKILL.md.agents/skills/postboi/SKILL.mdAGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest uses a prepare script and exposes the command-line program; it has no preinstall, install, or postinstall hook.
- The CLI asks for confirmation before first installing its agent skill.
- After an existing skill is detected, later setup runs refresh it and update companion agent locations.
- The skill command creates the target directory and installs package-provided agent material.
Evidence against
- No credential harvesting, unrelated network export, or install-time agent-control mutation was found in the inspected paths.
- The agent-skill write is reached through an explicit CLI setup or skill command, not package import.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/cli.jsView file
41// src/library/encoding.ts
L42: function base64_decode(value) {
L43: const binary = atob(value);
...
L125: const { pathToFileURL } = await import("node:url");
L126: let dir = process.cwd();
L127: for (;; ) {
...
L270: if (this.#hooks.before?.send) {
L271: return this.#hooks.before.send({
L272: provider: this.provider,
...
L319: async send_request(url, init) {
L320: return fetch(url, init);
L321: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4141// src/library/encoding.ts
L42: function base64_decode(value) {
L43: const binary = atob(value);
...
L125: const { pathToFileURL } = await import("node:url");
L126: let dir = process.cwd();
L127: for (;; ) {
...
L270: if (this.#hooks.before?.send) {
L271: return this.#hooks.before.send({
L272: provider: this.provider,
...
L319: async send_request(url, init) {
L320: return fetch(url, init);
L321: }
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L41791} from "node:fs";
L792: import { spawnSync } from "node:child_process";
L793: import { join as join7, delimiter, dirname as dirname4 } from "node:path";
Findings
2 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.55.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.55.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.