@bobfrankston/mailx-store-web@0.1.83: Malicious npm security | LPM Firewall

Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.83: Malicious npm security | LPM Firewall

Source & flagged code

5 flagged · loading source

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.81 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

136async addAccount(account: AccountConfig): Promise<void> { vlog(`addAccount id=${account.id} email=${account.email} host=${account.imap?.host} auth=${account.imap?.auth}`); this.db.upsertAccount(account.id, account.name, account.email, JSON.stringify(account)); // Idempotent: a provider already registered for this account is kept

High

Ai Review Evidence

Account setup logs account ID, email, IMAP host, and auth remotely.

android-bootstrap.tsView on unpkg · L136

1431// Find a Gmail account to use as the GDrive token provider let gmailTokenProvider: (() => Promise<string>) | null = null; for (const account of accounts) { if (!account.enabled) continue; const domain = account.email?.split("@")[1]?.toLowerCase() || ""; if (domain === "gmail.com" || domain === "googlemail.com") { const tp = createNativeTokenProvider(account.email); syncManager.setTokenProvider(account.id, tp); if (!gmailTokenProvider) gmailTokenProvider = tp; } await syncManager.addAccount(account); }

High

Ai Review Evidence

This occurs during initAndroid for enabled local/cloud accounts, without a separate telemetry opt-in.

android-bootstrap.tsView on unpkg · L1431

1534let setUp = 0; for (const account of accounts) { vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`); if (!account.enabled) { vlog(`init: ${account.id} disabled, skipping`); continue; } narrate(`Setting up ${account.email || account.id}… (${++setUp}/${enabled.length})`); const domain = account.email?.split("

High

Ai Review Evidence

This occurs during initAndroid for enabled local/cloud accounts, without a separate telemetry opt-in.

android-bootstrap.tsView on unpkg · L1534

sync-manager.tsView file

58} else if (account.imap?.host && account.imap?.user) { try { const provider = new ImapWebProvider({ server: account.imap.host, port: account.imap.port || 993, username: account.imap.user, password: account.imap.password, inactivityTimeout: 300000, fetchChunkSize: 10, fetchChunkSizeMax: 100, }, this.deps.createTcpTransport);

High

Ai Review Evidence

Android initialization serializes account.imap to that logger; IMAP configs include a password field.

sync-manager.tsView on unpkg · L58

Source & flagged code

5 flagged

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.81 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

Lines 116-156typescript

116 // On Android everything (incl. wa-sqlite) runs on the main thread, so

117 // overlapping runs stacked up: re-listing folders repeatedly, contending on

118 // the DB, and freezing the event loop ~1s at a time — the sync never

119 // advanced to fetching new mail, so the list stayed stale despite "Synced"

120 // (Bob 2026-06-27). Coalesce concurrent calls to one in-flight run.

121 private syncAllInflight: Promise<void> | null = null;

122 // Separate guard for the Phase-2/3 background pass (other folders + body

123 // prefetch). It runs DETACHED from the inbox guard so a long folder sweep

124 // can't make the 60s poll skip the inbox refresh (new mail must keep

125 // flowing). One background pass at a time — overlapping triggers no-op.

126 private bgSyncInflight: Promise<void> | null = null;

127

128 constructor(

129 private db: WebMailxDB,

130 private bodyStore: WebMessageStore,

131 ) {}

132

133 on(_event: string, _handler: (...args: any[]) => void): void { /* stub */ }

134 emit(event: string, ...args: any[]): void { emitEvent({ type: event, ...args[0] }); }

135

136 async addAccount(account: AccountConfig): Promise<void> {

137 vlog(`addAccount id=${account.id} email=${account.email} host=${account.imap?.host} auth=${account.imap?.auth}`);

138 this.db.upsertAccount(account.id, account.name, account.email, JSON.stringify(account));

139 // Idempotent: a provider already registered for this account is kept

High

Ai Review Evidence

Account setup logs account ID, email, IMAP host, and auth remotely.

android-bootstrap.tsView on unpkg · L136

140 // as-is. The Android bootstrap re-runs the account load periodically;

141 // recreating the provider each time built a fresh ImapWebProvider +

142 // BridgeTransport and replaced the live one — which orphaned any

143 // body fetch in flight on the old provider, so `fetchOne` came back

144 // with no source and the message showed "Body parsed empty". A real

145 // config change is rare and handled by a restart.

146 if (this.providers.has(account.id)) {

147 vlog(`addAccount ${account.id}: provider already registered — keeping it`);

148 return;

149 }

150 if (this.isGmailAccount(account)) {

151 const tokenProvider = this.tokenProviders.get(account.id);

152 if (tokenProvider) {

153 this.providers.set(account.id, new GmailApiWebProvider(tokenProvider));

154 console.log(`[sync] ${account.id}: Gmail API provider registered`);

155 } else {

156 console.warn(`[sync] ${account.id}: no token provider`);

Lines 1411-1451typescript

1411 // Main-thread path: async I/O (fetch, TCP bridge) doesn't block the UI,

1412 // and only sql.js is CPU-bound enough to maybe warrant a Worker later.

1413 // Worker path was reverted 2026-04-14 (stuck at "Initializing..." on Android).

1414 await waitForNativeBridge();

1415 if ((window as any)._nativeBridge && !(window as

Lines 1514-1554typescript

1514 } else {

1515 console.warn(`[android] List folder failed: ${lr.status}`);

1516 }

1517 } catch (e: any) {

1518 console.warn(`[android] List debug: ${

sync-manager.tsView file

Lines 38-78typescript

38 private bodyStore: WebMessageStore,

39 deps: SyncManagerDeps,

40 ) {

41 this.deps = deps;

42 }

43

44 on(_event: string, _handler: (...args: