Appflare catalog review, 2026-10-16

This evidence belongs to the version-specific article at:
https://mainbrella.com/blog/the-cloudflare-appstore-appflare-malware-audit/

Scope: 139 local catalog entries, 138 published artifacts. The extra local entry is Mainbrella Voice. Local catalog commit 0888859ed568c8a9c548f469518900550368c046; index generated 2026-10-15T09:00:26.406Z. Eleven source pins were newer than the already published version; both source snapshots and relevant differences were reviewed.

Method: Codex divided the entries among three review agents. Exact repository/commit archives were downloaded and safely extracted as regular files. Broad static scans plus targeted code/data-flow review covered manifest/build hooks, runtime requests, authentication, payment destinations, scheduled work, and suspicious dynamic-code patterns. Published manifests were compared to the index digests; all 16,203 manifest-listed file sizes and SHA256 hashes matched. Signatures were not independently reverified. Apps were not installed in a Cloudflare account, transitive/native dependency internals were not independently audited, and there was no reproducible rebuild or every-line human review.

Affected versions:
rdyrct 1.0.0, e9ba20e9bd2b65f9fbf7ed313b59e11fd90bd186.
888wiki 0.0.0-20261013.b9ed1c1, b9ed1c1393ccc650ab4dc5d580086fbb277b1736.

tracker-payloads.json and upload-payload.json are captured synthetic results from the audit. Names, links and file contents are test inputs, not private user data. No requests containing those inputs reached an external collector or file service.

To reproduce the focused checks, download the two CJS files and three .js.txt files in this folder to the same directory. Inspect them first, then use Node.js 22 or newer:

node reproduce-trackers.cjs
node reproduce-upload.cjs

The tracker check runs the already-inspected tracker snapshots in a mock browser context and intercepts fetch; it is not a full browser test. The upload check runs the extracted upload callback with a synthetic PDF and intercepts fetch. Both print the captured payload. Neither test establishes a real account takeover, a production collector retaining values, historical script behavior, or malicious author intent.

The Flow snapshot replaces its public, expiring collection token with SYNTHETIC_COLLECT_TOKEN to omit the audit request's IP-bound token. This changes no URL/title collection logic. snapshot.json records SHA256 hashes of the ORIGINAL fetched scripts, before that redaction. The live scripts may change. The audit snapshot did not include real account credentials.

Source qualifications: 888wiki's README mentions Flow analytics and external large-file/audio storage, and some Markdown upload buttons explicitly identify 888box. The attachment finding concerns the generic BlockNote upload callback, with no destination or note-password gate. Protected notes retain password protection; Flow still discloses their metadata. A related Webtalk path loads a hardcoded script despite its disabled setting and sends page text for suggestions only when chat is opened; it was statically traced, not reproduced as an initial-page-load content leak.

No upstream fixes, maintainer acknowledgement, exploit in the wild, or notifications are claimed by this article. The review is not assurance that the remaining apps are malware-free.

Third-party source snapshots/excerpts and their licenses are identified in third-party-notices.txt and AGPL-3.0.txt.