@bobfrankston/rmfmail@1.2.143: Malicious npm security report

Loading npm security reports…

@bobfrankston/rmfmail@1.2.143: Malicious npm security report | LPM Firewall

Source & flagged code

17 flagged

package.jsonView file

Lines 14-54json

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-send",

19 "packages/mailx-compose",

20 "packages/mailx-settings",

21 "packages/mailx-store",

22 "packages/mailx-store-web",

23 "packages/mailx-imap",

24 "packages/mailx-service",

25 "packages/mailx-api",

26 "client"

27 ],

28 "scripts": {

29 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

30 "watch": "tsc -w",

31 "release": "npmglobalize",

32 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

33 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts",

34 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@bobfrankston/iflow-direct": "^0.1.57",

38 "@bobfrankston/mailx-host": "^0.1.13",

39 "@bobfrankston/mailx-imap": "^0.1.117",

40 "@bobfrankston/mailx-store-web": "^0.1.38",

41 "@bobfrankston/mailx-sync": "^0.1.27",

42 "@bobfrankston/miscinfo": "^1.0.13",

43 "@bobfrankston/msger": "^0.1.394",

44 "@bobfrankston/node-tcp-transport": "^0.1.10",

45 "@bobfrankston/oauthsupport": "^1.0.34",

46 "@bobfrankston/rmf-tiny": "^0.1.38",

47 "@bobfrankston/smtp-direct": "^0.1.9",

48 "@bobfrankston/tcp-transport": "^0.1.8",

49 "@capacitor/android": "^8.3.0",

50 "@capacitor/cli": "^8.3.0",

51 "@capacitor/core": "^8.3.0",

52 "dictionary-en": "^4.0.0",

53 "express": "^4.21.0",

54 "html-to-docx": "^1.8.0",

bin/mailx.jsView file

Lines 33-74javascript

33 * by parsing the file's `From:` header against

34 * configured accounts. Falls back to the first

35 * "override" account (non-known-provider domain).

36 * rmfmail -

client/app.bundle.jsView file

Lines 10259-10299javascript

10259 acctEl.style.color = "oklch(0.65 0.2 25)";

10260 }

10261 break;

10262 }

10263 case "openMailto": {

10264 openComposeFromMailto({

10265

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

bin/build-bundles.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

8 * pulling in transitive deps, the WebView is paying that cost N times in

bin/rmfmailto.exeView file

•path = bin/rmfmailto.exe kind = native_binary sizeBytes = 310272 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfmailto.exeView on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

packages/mailx-service/index.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = packages/mailx-service/index.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

packages/mailx-service/index.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = packages/mailx-service/index.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.tsView on unpkg

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/mailx.jsView file

54import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo";

High

Child Process

Package source references child process execution.

bin/mailx.jsView on unpkg · L54

268// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L269: // cmd.exe's shell layer, which strips one level before the value reaches L270: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L268

53Cross-file remote execution chain: bin/mailx.js spawns bin/popout-server.js; helper contains network access plus dynamic code execution. L53: import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L185: // Linux pickers read Name= from the .desktop file directly. L186: if (process.platform === "linux") { L187: const appsDir = path.join(os.homedir(), ".local", "share", "applications"); L188: const desktopPath = path.join(appsDir, "rmfmail.desktop"); ... L246: // (shipped in the npm package) to the per-app location below. L247: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L248: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L268: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/mailx.jsView on unpkg · L53

2500clearInstanceFile(); L2501: const { spawn: spawnChild } = await import("child_process"); L2502: const child = spawnChild("rmfmail", [], { detached: true, stdio: "ignore", shell: true, windowsHide: true }); ... L2515: } L2516: // Auto-update action: run npm install then restart L2517: if (req._action === "performUpdate") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L2500

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.140 matchedPath = bin/mailx.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.140 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

53import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L185: // Linux pickers read Name= from the .desktop file directly. L186: if (process.platform === "linux") { L187: const appsDir = path.join(os.homedir(), ".local", "share", "applications"); L188: const desktopPath = path.join(appsDir, "rmfmail.desktop"); ... L246: // (shipped in the npm package) to the per-app location below. L247: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L248: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L268: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/mailx.jsView on unpkg · L53

client/app.bundle.jsView file

10279try { L10280: const fn = new Function(`return (async () => (${code}))();`); L10281: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L10279

bin/lean-accounts.jsView file

137package = @bobfrankston/rmfmail; repositoryIdentity = mailx; dependency = jsonc-parser L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null); L139: if (mod) { parseJsonc = mod.parse; break; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/lean-accounts.jsView on unpkg · L137

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

bin/build-bundles.mjsView file

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L148: logLevel: "info", L149: // .wasm files are inlined as base64 data URLs so the runtime can L150: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L151: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L152: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/rmfmailto.exeView file

•path = bin/rmfmailto.exe kind = native_binary sizeBytes = 310272 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfmailto.exeView on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

packages/mailx-service/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

packages/mailx-service/index.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.tsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 14-54json

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-send",

19 "packages/mailx-compose",

20 "packages/mailx-settings",

21 "packages/mailx-store",

22 "packages/mailx-store-web",

23 "packages/mailx-imap",

24 "packages/mailx-service",

25 "packages/mailx-api",

26 "client"

27 ],

28 "scripts": {

30 "watch": "tsc -w",

31 "release": "npmglobalize",

32 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

34 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "dependencies": {

37 "@bobfrankston/iflow-direct": "^0.1.57",

38 "@bobfrankston/mailx-host": "^0.1.13",

39 "@bobfrankston/mailx-imap": "^0.1.117",

40 "@bobfrankston/mailx-store-web": "^0.1.38",

41 "@bobfrankston/mailx-sync": "^0.1.27",

42 "@bobfrankston/miscinfo": "^1.0.13",

43 "@bobfrankston/msger": "^0.1.394",

44 "@bobfrankston/node-tcp-transport": "^0.1.10",

45 "@bobfrankston/oauthsupport": "^1.0.34",

46 "@bobfrankston/rmf-tiny": "^0.1.38",

47 "@bobfrankston/smtp-direct": "^0.1.9",

48 "@bobfrankston/tcp-transport": "^0.1.8",

49 "@capacitor/android": "^8.3.0",

50 "@capacitor/cli": "^8.3.0",

51 "@capacitor/core": "^8.3.0",

52 "dictionary-en": "^4.0.0",

53 "express": "^4.21.0",

54 "html-to-docx": "^1.8.0",

bin/mailx.jsView file

Lines 33-74javascript

33 * by parsing the file's `From:` header against

34 * configured accounts. Falls back to the first

35 * "override" account (non-known-provider domain).

36 * rmfmail -

client/app.bundle.jsView file

Lines 10259-10299javascript

10259 acctEl.style.color = "oklch(0.65 0.2 25)";

10260 }

10261 break;

10262 }

10263 case "openMailto": {

10264 openComposeFromMailto({

10265

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

bin/build-bundles.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

8 * pulling in transitive deps, the WebView is paying that cost N times in

bin/rmfmailto.exeView file

•path = bin/rmfmailto.exe kind = native_binary sizeBytes = 310272 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfmailto.exeView on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

packages/mailx-service/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

packages/mailx-service/index.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.tsView on unpkg

Lines 248-288javascript

248 const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe");

249 const __pkgRmfmailtoExe = path.join(import.meta.dirname, "rmfmailto.exe");

250 if (fs.existsSync(__pkgRmfmailtoExe) && (!fs.existsSync(__rmfmailtoExe) ||

251 fs.statSync(__pkgRmfmailtoExe).mtimeMs > fs.statSync(__rmfmailtoExe).mtimeMs)) {

252 try {

253 fs.mkdirSync(__perAppBin, { recursive: true });

254 fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe);

255 console.log(`Installed rmfmailto.exe to ${__rmfmailtoExe}`);

256 }

257 catch (e) {

258 console.error(`Failed to copy rmfmailto.exe to per-app dir: ${e.message}`);

259 // Fall through and try registering the in-package path so

260 // mailto still works, just from inside node_modules.

261 }

262 }

263 const __launcherExe = fs.existsSync(__rmfmailtoExe) ? __rmfmailtoExe : __pkgRmfmailtoExe;

264 if (!fs.existsSync(__launcherExe)) {

265 console.error(`rmfmailto.exe not found at ${__launcherExe} — package may have been built without it. Re-run 'npm run build' on the build machine.`);

266 process.exit(1);

267 }

268 // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

269 // cmd.exe's shell layer, which strips one level before the value reaches

270 // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L268

271 // the EXE's argv layer.

272 const cmd = `\\"${__launcherExe}\\" \\"%1\\"`;

273 const keys = [

274 // [hive\\path, value-name, value-data]

275 [`HKCU\\Software\\Classes\\rmfmail\\shell\\open\\command`, "", cmd],

276 [`HKCU\\Software\\Classes\\rmfmail\\DefaultIcon`, "", `\\"${path.join(import.meta.dirname, "..", "client", "icon.ico")}\\",0`

277 [`HKCU\\Software\\Classes\\rmfmail`, "URL Protocol", ""],

278 [`HKCU\\Software\\Classes\\rmfmail`, "", "URL:rmfmail Protocol"],

279 // Make rmfmail visible in Settings → Default apps → Email so the

280 // user can flip it to default with one click.

281 [`HKCU\\Software\\Clients\\Mail\\rmfmail`, "", "rmfmail"],

282 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationName", "rmfmail"],

283 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationDescription", "Local-first email client"],

284 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities\\URLAssociations`, "mailto", "rmfmail"],

285 [`HKCU\\Software\\RegisteredApplications`, "rmfmail", "Software\\Clients\\Mail\\rmfmail\\Capabilities"],

286 // Belt-and-suspenders for the Win11 picker's display-name lookup:

287 // some code paths read `HKCU\Software\Classes\Applications\<exe>`

288 // for the FriendlyAppName even when the registered ProgId already

@bobfrankston/rmfmail@1.2.143

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code