registry  /  usrcp-gmail  /  0.2.1

usrcp-gmail@0.2.1

Gmail capture adapter for USRCP - polls the configured user's SENT messages and appends them to the local ledger

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook is intrusive but limited to rebuilding better-sqlite3 native build directories; runtime Gmail access is the advertised adapter function.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install runs postinstall; user runs usrcp-gmail or usrcp setup --adapter=gmail for runtime/setup behavior
Impact
Reads configured user's sent Gmail messages and stores capped event details locally as documented; no source evidence of exfiltration outside Google APIs or USRCP local storage.
Mechanism
local Gmail sent-mail polling into USRCP ledger
Rationale
Static inspection shows a Gmail adapter that asks for OAuth credentials, validates with Gmail, polls sent messages, and records them locally; these behaviors match the package purpose. The scanner's lifecycle concern is real but appears to be a native-module rebuild workaround rather than malware because it touches only better-sqlite3 build paths and performs no exfiltration or persistence.
Evidence
package.jsondist/index.jsdist/setup.jsdist/reader.jsdist/config.jsdist/capture.jsREADME.mdnode_modules/better-sqlite3/buildnode_modules/usrcp-core/node_modules/better-sqlite3/buildnode_modules/usrcp-stream/node_modules/better-sqlite3/build~/.usrcp/gmail-config.json
Network endpoints3
www.googleapis.com/auth/gmail.readonlyconsole.cloud.google.comdevelopers.google.com/oauthplayground

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json postinstall deletes better-sqlite3 build dirs and runs npm rebuild better-sqlite3 at install time
  • dist/index.js has user-invoked --reset-config execSync('usrcp setup --adapter=gmail')
  • dist/setup.js collects OAuth client secret and refresh token for Gmail setup
Evidence against
  • No import-time execution beyond CLI main; package behavior is a Gmail poller/bin
  • Network use is package-aligned: Gmail OAuth/API validation and sent-message polling
  • Secrets are passed to Google OAuth/Gmail clients and local encrypted config store, not arbitrary endpoints
  • dist/capture.js writes normalized sent-mail events to local USRCP ledger with bounded fields
  • rg found no eval/vm/Function, arbitrary fetch/curl/wget, persistence, destructive user-file operations, or AI-agent control writes
Behavioral surface
Source
ChildProcessCryptoEnvironmentVars
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 5 file(s), 36.9 KB of source, external domains: www.googleapis.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "const fs=require(\"fs\"); for (const p of [\"node_modules/better-sqlite3/build\",\"node_modules/usrcp-core/node_modules/better-sqlite3/build\",\"node_modules/usrcp-stream/...
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.postinstall = node -e "const fs=require(\"fs\"); for (const p of [\"node_modules/better-sqlite3/build\",\"node_modules/usrcp-core/node_modules/better-sqlite3/build\",\"node_modules/usrcp-stream/...
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 Critical1 High1 Medium2 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumEnvironment Vars
LowScripts Present
LowUrl Strings