postboi@0.73.0
Postboi is an email provider and TypeScript SDK. Send email with one token and no DNS setup, plus SMS, WhatsApp, push and chat from the same API. You can also use your own provider (Resend, SES, Postmark and more) if you want to.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest's prepare hook only runs Svelte synchronization, and the flagged CLI behavior is user-invoked. Its API client forwards a bearer token to an unrestricted configured base URL, so conditional credential exposure warrants a warning; the source does not establish a hidden default recipient.
Decision evidence
public snapshot- The manifest exposes the CLI as a bin; its prepare hook only runs Svelte synchronization.
- The CLI defaults to postboi.app but accepts POSTBOI_API_URL without restricting the destination.
- A CLI API request reads POSTBOI_TOKEN and sends it as a bearer token to the selected server.
- The CLI dispatches commands from the user's arguments.
- The default API host is postboi.app, which is aligned with the package.
- The token transfer requires an API command to be invoked; no install-time token transfer is shown.
Source & flagged code
6 flaggedSource appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L69Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L69Package source references child process execution.
Findings
Affected versions and remediation
This report applies to postboi@0.73.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.73.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.