postboi@0.72.0
Postboi is an email provider and TypeScript SDK. Send email with one token and no DNS setup, plus SMS, WhatsApp, push and chat from the same API. You can also use your own provider (Resend, SES, Postmark and more) if you want to.
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe source does not support the scanner's malicious verdict: the install hook is ordinary Svelte setup, and inspected credential syncing and agent skill setup are CLI behaviors requiring user action or confirmation. The other flagged network behavior inspected is normal Turnstile captcha verification.
Decision evidence
public snapshot- The package's prepare hook runs Svelte sync; it does not invoke the CLI.
- Agent skill installation from init requires confirmation, and targets Postboi's own skill files.
- CLI credential sync requires a POSTBOI_TOKEN and sends credentials through the Postboi account sync flow.
- Captcha verification sends the submitted token and configured secret to the Turnstile verification endpoint.
- The inspected credential and agent-configuration behavior is tied to CLI setup or sync, not an automatic package-install action.
Source & flagged code
6 flaggedSource appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L69Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L69Package source references child process execution.
Findings
Affected versions and remediation
This report applies to postboi@0.72.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.72.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.