postboi@0.59.0
Postboi is an email provider and TypeScript SDK. Send email with one token and no DNS setup, plus SMS, WhatsApp, push and chat from the same API. You can also use your own provider (Resend, SES, Postmark and more) if you want to.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe scanner's malicious label is not supported by the inspected credential, browser, or shell behavior. The concrete agent configuration and update capability warrants a warning under the guarded integration policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running postboi skill, accepting the skill during setup, or later running project preparation after setup.
Impact
Later package updates can change instructions consumed by coding agents without renewed confirmation.
Mechanism
The CLI writes or links package-owned skills, appends an AGENTS.md pointer, and refreshes an existing skill during postboi sync.
AI rationale
The scanner's malicious label is not supported by the inspected credential, browser, or shell behavior. The concrete agent configuration and update capability warrants a warning under the guarded integration policy.
Evidence
dist/cli.js.claude/skills/postboi/SKILL.md.agents/skills/postboi/SKILL.mdAGENTS.mdpackage.json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has a build preparation hook, no preinstall/install/postinstall hook, and no runtime self-dependency.
- The explicit skill command installs agent guidance; interactive setup asks before initially installing the skill.
- The CLI targets .claude/skills/postboi/SKILL.md and .agents/skills/postboi/SKILL.md and appends guidance to an existing AGENTS.md.
- Installed skills become links to package content, allowing subsequent package releases to change agent guidance.
- Setup adds postboi sync to the consumer project's prepare hook; sync refreshes an existing skill without renewed confirmation.
Evidence against
- No concrete covert credential theft or malicious install chain was established.
- Microsoft 365 credentials authenticate to Microsoft's OAuth endpoint; inbox shell execution requires a caller-supplied flag.
- The apparent browser password field is disabled display content.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
7 flaggeddist/cli.jsView file
41// src/library/encoding.ts
L42: function base64_decode(value) {
L43: const binary = atob(value);
...
L125: const { pathToFileURL } = await import("node:url");
L126: let dir = process.cwd();
L127: for (;; ) {
...
L270: if (this.#hooks.before?.send) {
L271: return this.#hooks.before.send({
L272: provider: this.provider,
...
L319: async send_request(url, init) {
L320: return fetch(url, init);
L321: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4141// src/library/encoding.ts
L42: function base64_decode(value) {
L43: const binary = atob(value);
...
L125: const { pathToFileURL } = await import("node:url");
L126: let dir = process.cwd();
L127: for (;; ) {
...
L270: if (this.#hooks.before?.send) {
L271: return this.#hooks.before.send({
L272: provider: this.provider,
...
L319: async send_request(url, init) {
L320: return fetch(url, init);
L321: }
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L41•matchType = previous_version_dangerous_delta
matchedPackage = postboi@0.57.0
matchedIdentity = npm:cG9zdGJvaQ:0.57.0
similarity = 0.917
summary = stored previous version shares package body but lacks this dangerous source file
Findings
3 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to postboi@0.59.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.59.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.