postboi@0.75.0
Postboi is an email provider and TypeScript SDK. Send email with one token and no DNS setup, plus SMS, WhatsApp, push and chat from the same API. You can also use your own provider (Resend, SES, Postmark and more) if you want to.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest’s prepare hook only runs SvelteKit synchronization, and the CLI network paths inspected serve Postboi product features. The scanner’s credential labels were not supported by source showing browser credential collection or unrelated credential transfer.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
No malicious trigger was found; the reviewed network operations occur when a developer requests the corresponding API or inbox screenshot operation.
Impact
No harmful impact was identified in the reviewed source.
Mechanism
No malicious mechanism was found. The CLI uses a configured Postboi token for product API requests, while the webhook handler validates signatures with the configured secret.
AI rationale
The manifest’s prepare hook only runs SvelteKit synchronization, and the CLI network paths inspected serve Postboi product features. The scanner’s credential labels were not supported by source showing browser credential collection or unrelated credential transfer.
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json’s prepare script runs SvelteKit synchronization and exposes dist/cli.js as the postboi command.
- The CLI requires a POST to the inbox screenshot route and a configured POSTBOI_TOKEN before uploading a capture to the Postboi testing API.
- The inspected inbox runtime hint subscribes to local store changes and removes the subscription when the connection closes.
- inbox_art.js exports embedded PNG data as an asset map.
- The views client requires a Postboi token and sends it as a bearer token to the configured API, defaulting to postboi.app.
- The Vonage webhook handler checks the HS256 signature using the configured secret.
Evidence against
- Scanner labels report credential exfiltration and browser credential collection in dist/cli.js; inspected source instead shows product API operations, with no browser credential-store collection identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
10 flaggeddist/cli.jsView file
69class: "Resend",
L70: url: "https://resend.com/api-keys",
L71: fields: [
...
L439: {
L440: env: "MJ_APIKEY_PRIVATE",
L441: arg: "api_secret",
...
L614: {
L615: env: "GMAIL_PRIVATE_KEY",
L616: arg: "private_key",
...
L1509: // src/library/encoding.ts
L1510: function base64_decode(value) {
L1511: const binary = atob(value);
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L6969class: "Resend",
L70: url: "https://resend.com/api-keys",
L71: fields: [
...
L439: {
L440: env: "MJ_APIKEY_PRIVATE",
L441: arg: "api_secret",
...
L614: {
L615: env: "GMAIL_PRIVATE_KEY",
L616: arg: "private_key",
...
L1509: // src/library/encoding.ts
L1510: function base64_decode(value) {
L1511: const binary = atob(value);
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.jsView on unpkg · L695656} from "node:fs";
L5657: import { spawnSync } from "node:child_process";
L5658: import { join as join12, delimiter, dirname as dirname7 } from "node:path";
High
Child Process
Package source references child process execution.
Findings
2 Critical7 High4 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalBrowser Credential Phishingdist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighKnown Malware Source Similaritydist/cli.js
HighKnown Malware Source Similaritydist/inbox_server.js
HighKnown Malware Source Similaritydist/views.js
HighKnown Malware Source Similaritydist/webhooks/vonage.js
MediumDynamic Requiredist/workers_env.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to postboi@0.75.0.
See all versions of postboi for other recorded verdicts.
- Review the evidence and your use of postboi@0.75.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.