Loading npm security reports…
When the Android bootstrap is initialized with mail accounts, it transmits account diagnostics to a hard-coded third-party logging host. The transmitted IMAP configuration can include the account password.
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
worker-entry.tsView on unpkg · L37Source file is highly similar to a previously finalized malicious package; route for source-aware review.
worker-bundle.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
worker-bundle.jsView on unpkgAccount email addresses and IMAP hosts are also sent through the same logging path.
android-bootstrap.jsView on unpkg · L129This report applies to @bobfrankston/mailx-store-web@0.1.112.
See version security history for other recorded verdicts.
Evidence last updated: .
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
worker-entry.tsView on unpkg · L37Source file is highly similar to a previously finalized malicious package; route for source-aware review.
worker-bundle.jsView on unpkgSource fingerprint signature matches a known malicious package signature; route for source-aware review.
worker-bundle.jsView on unpkgAccount email addresses and IMAP hosts are also sent through the same logging path.
android-bootstrap.jsView on unpkg · L129