Loading npm security reports…

@bobfrankston/rmfmail@1.2.142: Malicious npm security report | LPM Firewall

registry / @bobfrankston/rmfmail / 1.2.142

@bobfrankston/rmfmail@1.2.142

Local-first email client with IMAP sync and standalone native app

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The Android bootstrap silently transmits diagnostic strings to an unrelated external host. Account startup logs include email metadata and serialize IMAP configuration, which can include the account password.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Launching the Android client with configured accounts; account initialization/registration activates it.

Impact

External collection of mailbox identifiers, email addresses, server details, and potentially IMAP passwords.

Mechanism

Unconsented HTTPS credential and account-data exfiltration through verbose telemetry.

Attack narrative

On Android startup, `client/index.html` loads `client/android-bootstrap.bundle.js`. Its source-equivalent `packages/mailx-store-web/android-bootstrap.ts` calls `vlog` during account registration and initialization. `vlog` performs a best-effort request to `https://rmf39.aaz.lt/logit/`; one logged message includes `JSON.stringify(account.imap)`. The declared account type permits `imap.password`, making credential disclosure a concrete runtime outcome without user consent.

Rationale

The package contains a concrete, externally directed runtime exfiltration path for account data and potentially IMAP passwords. Benign local lifecycle and explicit MCP behavior do not mitigate this path.

Evidence

client/index.htmlclient/android-bootstrap.bundle.jspackages/mailx-store-web/android-bootstrap.tspackages/mailx-types/index.tsbin/postinstall.jsbin/mcp-server.js

Network endpoints

Source & flagged code

17 flagged

package.jsonView file

Lines 14-54json

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-send",

19 "packages/mailx-compose",

20 "packages/mailx-settings",

21 "packages/mailx-store",

22 "packages/mailx-store-web",

23 "packages/mailx-imap",

24 "packages/mailx-service",

25 "packages/mailx-api",

26 "client"

27 ],

28 "scripts": {

29 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

30 "watch": "tsc -w",

31 "release": "npmglobalize",

32 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

33 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts",

34 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@bobfrankston/iflow-direct": "^0.1.57",

38 "@bobfrankston/mailx-host": "^0.1.13",

39 "@bobfrankston/mailx-imap": "^0.1.117",

40 "@bobfrankston/mailx-store-web": "^0.1.38",

41 "@bobfrankston/mailx-sync": "^0.1.27",

42 "@bobfrankston/miscinfo": "^1.0.13",

43 "@bobfrankston/msger": "^0.1.394",

44 "@bobfrankston/node-tcp-transport": "^0.1.10",

45 "@bobfrankston/oauthsupport": "^1.0.34",

46 "@bobfrankston/rmf-tiny": "^0.1.38",

47 "@bobfrankston/smtp-direct": "^0.1.9",

48 "@bobfrankston/tcp-transport": "^0.1.8",

49 "@capacitor/android": "^8.3.0",

50 "@capacitor/cli": "^8.3.0",

51 "@capacitor/core": "^8.3.0",

52 "dictionary-en": "^4.0.0",

53 "express": "^4.21.0",

54 "html-to-docx": "^1.8.0",

bin/mailx.jsView file

Lines 33-74javascript

33 * by parsing the file's `From:` header against

34 * configured accounts. Falls back to the first

35 * "override" account (non-known-provider domain).

36 * rmfmail -

client/app.bundle.jsView file

Lines 10259-10299javascript

10259 acctEl.style.color = "oklch(0.65 0.2 25)";

10260 }

10261 break;

10262 }

10263 case "openMailto": {

10264 openComposeFromMailto({

10265

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

bin/build-bundles.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

8 * pulling in transitive deps, the WebView is paying that cost N times in

bin/rmfmailto.exeView file

•path = bin/rmfmailto.exe kind = native_binary sizeBytes = 310272 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfmailto.exeView on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

packages/mailx-service/index.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = packages/mailx-service/index.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

packages/mailx-service/index.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = packages/mailx-service/index.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.tsView on unpkg

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/mailx.jsView file

54import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo";

High

Child Process

Package source references child process execution.

bin/mailx.jsView on unpkg · L54

268// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L269: // cmd.exe's shell layer, which strips one level before the value reaches L270: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L268

53Cross-file remote execution chain: bin/mailx.js spawns bin/popout-server.js; helper contains network access plus dynamic code execution. L53: import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L185: // Linux pickers read Name= from the .desktop file directly. L186: if (process.platform === "linux") { L187: const appsDir = path.join(os.homedir(), ".local", "share", "applications"); L188: const desktopPath = path.join(appsDir, "rmfmail.desktop"); ... L246: // (shipped in the npm package) to the per-app location below. L247: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L248: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L268: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/mailx.jsView on unpkg · L53

2500clearInstanceFile(); L2501: const { spawn: spawnChild } = await import("child_process"); L2502: const child = spawnChild("rmfmail", [], { detached: true, stdio: "ignore", shell: true, windowsHide: true }); ... L2515: } L2516: // Auto-update action: run npm install then restart L2517: if (req._action === "performUpdate") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L2500

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = bin/mailx.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

53import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L185: // Linux pickers read Name= from the .desktop file directly. L186: if (process.platform === "linux") { L187: const appsDir = path.join(os.homedir(), ".local", "share", "applications"); L188: const desktopPath = path.join(appsDir, "rmfmail.desktop"); ... L246: // (shipped in the npm package) to the per-app location below. L247: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L248: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L268: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/mailx.jsView on unpkg · L53

client/app.bundle.jsView file

10279try { L10280: const fn = new Function(`return (async () => (${code}))();`); L10281: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L10279

bin/lean-accounts.jsView file

137package = @bobfrankston/rmfmail; repositoryIdentity = mailx; dependency = jsonc-parser L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null); L139: if (mod) { parseJsonc = mod.parse; break; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/lean-accounts.jsView on unpkg · L137

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

bin/build-bundles.mjsView file

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L148: logLevel: "info", L149: // .wasm files are inlined as base64 data URLs so the runtime can L150: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L151: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L152: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/rmfmailto.exeView file

•path = bin/rmfmailto.exe kind = native_binary sizeBytes = 310272 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfmailto.exeView on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

packages/mailx-service/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

packages/mailx-service/index.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.tsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 14-54json

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-send",

19 "packages/mailx-compose",

20 "packages/mailx-settings",

21 "packages/mailx-store",

22 "packages/mailx-store-web",

23 "packages/mailx-imap",

24 "packages/mailx-service",

25 "packages/mailx-api",

26 "client"

27 ],

28 "scripts": {

30 "watch": "tsc -w",

31 "release": "npmglobalize",

32 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

34 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@bobfrankston/iflow-direct": "^0.1.57",

38 "@bobfrankston/mailx-host": "^0.1.13",

39 "@bobfrankston/mailx-imap": "^0.1.117",

40 "@bobfrankston/mailx-store-web": "^0.1.38",

41 "@bobfrankston/mailx-sync": "^0.1.27",

42 "@bobfrankston/miscinfo": "^1.0.13",

43 "@bobfrankston/msger": "^0.1.394",

44 "@bobfrankston/node-tcp-transport": "^0.1.10",

45 "@bobfrankston/oauthsupport": "^1.0.34",

46 "@bobfrankston/rmf-tiny": "^0.1.38",

47 "@bobfrankston/smtp-direct": "^0.1.9",

48 "@bobfrankston/tcp-transport": "^0.1.8",

49 "@capacitor/android": "^8.3.0",

50 "@capacitor/cli": "^8.3.0",

51 "@capacitor/core": "^8.3.0",

52 "dictionary-en": "^4.0.0",

53 "express": "^4.21.0",

54 "html-to-docx": "^1.8.0",

bin/mailx.jsView file

Lines 33-74javascript

33 * by parsing the file's `From:` header against

34 * configured accounts. Falls back to the first

35 * "override" account (non-known-provider domain).

36 * rmfmail -

client/app.bundle.jsView file

Lines 10259-10299javascript

10259 acctEl.style.color = "oklch(0.65 0.2 25)";

10260 }

10261 break;

10262 }

10263 case "openMailto": {

10264 openComposeFromMailto({

10265

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

bin/build-bundles.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

8 * pulling in transitive deps, the WebView is paying that cost N times in

bin/rmfmailto.exeView file

•path = bin/rmfmailto.exe kind = native_binary sizeBytes = 310272 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfmailto.exeView on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

packages/mailx-service/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

packages/mailx-service/index.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.tsView on unpkg

Lines 248-288javascript

248 const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe");

249 const __pkgRmfmailtoExe = path.join(import.meta.dirname, "rmfmailto.exe");

250 if (fs.existsSync(__pkgRmfmailtoExe) && (!fs.existsSync(__rmfmailtoExe) ||

251 fs.statSync(__pkgRmfmailtoExe).mtimeMs > fs.statSync(__rmfmailtoExe).mtimeMs)) {

252 try {

253 fs.mkdirSync(__perAppBin, { recursive: true });

254 fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe);

255 console.log(`Installed rmfmailto.exe to ${__rmfmailtoExe}`);

256 }

257 catch (e) {

258 console.error(`Failed to copy rmfmailto.exe to per-app dir: ${e.message}`);

259 // Fall through and try registering the in-package path so

260 // mailto still works, just from inside node_modules.

261 }

262 }

263 const __launcherExe = fs.existsSync(__rmfmailtoExe) ? __rmfmailtoExe : __pkgRmfmailtoExe;

264 if (!fs.existsSync(__launcherExe)) {

265 console.error(`rmfmailto.exe not found at ${__launcherExe} — package may have been built without it. Re-run 'npm run build' on the build machine.`);

266 process.exit(1);

267 }

268 // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

269 // cmd.exe's shell layer, which strips one level before the value reaches

270 // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L268

271 // the EXE's argv layer.

272 const cmd = `\\"${__launcherExe}\\" \\"%1\\"`;

273 const keys = [

274 // [hive\\path, value-name, value-data]

275 [`HKCU\\Software\\Classes\\rmfmail\\shell\\open\\command`, "", cmd],

276 [`HKCU\\Software\\Classes\\rmfmail\\DefaultIcon`, "", `\\"${path.join(import.meta.dirname, "..", "client", "icon.ico")}\\",0`

277 [`HKCU\\Software\\Classes\\rmfmail`, "URL Protocol", ""],

278 [`HKCU\\Software\\Classes\\rmfmail`, "", "URL:rmfmail Protocol"],

279 // Make rmfmail visible in Settings → Default apps → Email so the

280 // user can flip it to default with one click.

281 [`HKCU\\Software\\Clients\\Mail\\rmfmail`, "", "rmfmail"],

282 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationName", "rmfmail"],

283 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationDescription", "Local-first email client"],

284 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities\\URLAssociations`, "mailto", "rmfmail"],

285 [`HKCU\\Software\\RegisteredApplications`, "rmfmail", "Software\\Clients\\Mail\\rmfmail\\Capabilities"],

286 // Belt-and-suspenders for the Win11 picker's display-name lookup:

287 // some code paths read `HKCU\Software\Classes\Applications\<exe>`

288 // for the FriendlyAppName even when the registered ProgId already

@bobfrankston/rmfmail@1.2.142

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code