@bobfrankston/mailx-store-web@0.1.77: Malicious npm security

Loading npm security reports…

Source & flagged code

7 flagged

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.250 matchedPath = packages/mailx-store-web/worker-bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.250 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 790cfc6e66eb1718 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.76 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.76 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

Lines 34-74typescript

34let syncManager: AndroidSyncManager;

35const eventHandlers: ((event: any) => void)[] = [];

37// ── Event emitter ──

39function emitEvent(

Lines 116-181typescript

116 // On Android everything (incl. wa-sqlite) runs on the main thread, so

117 // overlapping runs stacked up: re-listing folders repeatedly, contending on

118 // the DB, and freezing the event loop ~1s at a time — the sync never

119 // advanced to fetching new mail, so the list stayed stale despite "Synced"

120 // (Bob 2026-06-27). Coalesce concurrent calls to one in-flight run.

121 private syncAllInflight: Promise<void> | null =

Lines 1515-1555typescript

1515 console.warn(`[android] List folder failed: ${lr.status}`);

1516 }

1517 } catch (e: any) {

1518 console.warn(`[android] List debug: ${e.message}`);

Lines 1582-1622typescript

1582 // is how Android gets contacts it never saw in its own partial corpus.

1583 // 2. Google People API — keeps Google-side contacts current. Runs for

1584 // Google accounts ONLY; an IMAP account has no People API and would

1585 // pop a bogus OAuth consent.

1586 service.loadContactsConfig()

1587 .catch((e: any) => console.error

Source & flagged code

7 flagged · loading source

worker-bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

@bobfrankston/mailx-store-web@0.1.77: Malicious npm security | LPM Firewall

Source & flagged code

7 flagged

worker-bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

Lines 34-74typescript

34let syncManager: AndroidSyncManager;

35const eventHandlers: ((event: any) => void)[] = [];

37// ── Event emitter ──

39function emitEvent(

Lines 116-181typescript

116 // On Android everything (incl. wa-sqlite) runs on the main thread, so

117 // overlapping runs stacked up: re-listing folders repeatedly, contending on

118 // the DB, and freezing the event loop ~1s at a time — the sync never

119 // advanced to fetching new mail, so the list stayed stale despite "Synced"

120 // (Bob 2026-06-27). Coalesce concurrent calls to one in-flight run.

121 private syncAllInflight: Promise<void> | null =

Lines 1515-1555typescript

1515 console.warn(`[android] List folder failed: ${lr.status}`);

1516 }

1517 } catch (e: any) {

1518 console.warn(`[android] List debug: ${e.message}`);

Lines 1582-1622typescript

1582 // is how Android gets contacts it never saw in its own partial corpus.

1583 // 2. Google People API — keeps Google-side contacts current. Runs for

1584 // Google accounts ONLY; an IMAP account has no People API and would

1585 // pop a bogus OAuth consent.

1586 service.loadContactsConfig()

1587 .catch((e: any) => console.error

@bobfrankston/mailx-store-web@0.1.77

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code