@bobfrankston/rmfmail@1.2.223: Malicious npm security report | LPM Firewall

Loading npm security reports…

@bobfrankston/rmfmail@1.2.223: Malicious npm security report | LPM Firewall

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/mailx.jsView file

54import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo";

High

Child Process

Package source references child process execution.

bin/mailx.jsView on unpkg · L54

242// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

53Cross-file remote execution chain: bin/mailx.js spawns bin/popout-server.js; helper contains network access plus dynamic code execution. L53: import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L221: // (shipped in the npm package) to the per-app location below. L222: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L223: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L242: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before ... L380: // Linux pickers

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/mailx.jsView on unpkg · L53

53Trigger-reachable persistence chain: manifest.main -> bin/mailx.js L53: import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L221: // (shipped in the npm package) to the per-app location below. L222: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L223: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L242: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before ... L380: // Linux pickers read Name= from the .desktop file directly. L381: if (process.platfor

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/mailx.jsView on unpkg · L53

641// session — inherits it. On Windows a process's cwd holds the directory L642: // locked, so `npm install -g` (the in-app self-update AND a manual update) L643: // dies with EBUSY renaming .../rmfmail/bin for as long as we run ... L654: if (!verbose && !isDaemon && !process.argv.slice(2).some(a => /^-/.test(a))) { L655: const { spawn } = await import("node:child_process"); L656: const child = spawn(process.execPath, [...process.argv.slice(1), "--daemon"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L641

53import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L221: // (shipped in the npm package) to the per-app location below. L222: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L223: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L242: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before ... L380: // Linux pickers read Name= from the .desktop file directly. L381: if (process.platform === "linux") {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/mailx.jsView on unpkg · L53

client/app.bundle.jsView file

10808try { L10809: const fn = new Function(`return (async () => (${code}))();`); L10810: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L10808

bin/lean-accounts.jsView file

137package = @bobfrankston/rmfmail; repositoryIdentity = mailx; dependency = jsonc-parser L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null); L139: if (mod) { parseJsonc = mod.parse; break; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/lean-accounts.jsView on unpkg · L137

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

bin/build-bundles.mjsView file

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L148: logLevel: "info", L149: // .wasm files are inlined as base64 data URLs so the runtime can L150: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L151: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L152: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.211 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.211 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.211 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.211 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.211 matchedPath = bin/share-target.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.211 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.211 matchedPath = bin/share-target.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.211 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

packages/mailx-store-web/worker-bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.211 matchedPath = packages/mailx-store-web/worker-bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.211 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-store-web/worker-bundle.jsView on unpkg

Lines 222-262javascript

222 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

223 const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe");

224 const __pkgRmfmailtoExe = path.join(import.meta.dirname, "rmfmailto.exe");

225 if (fs.existsSync(__pkgRmfmailtoExe) && (!fs.existsSync(__rmfmailtoExe) ||

226 fs.statSync(__pkgRmfmailtoExe).mtimeMs > fs.statSync(__rmfmailtoExe).mtimeMs)) {

227 try {

228 fs.mkdirSync(__perAppBin, { recursive: true });

229 fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe);

230 lines.push(`Installed rmfmailto.exe to ${__rmfmailtoExe}`);

231 }

232 catch (e) {

233 lines.push(`Failed to copy rmfmailto.exe to per-app dir: ${e.message}`);

234 // Fall through and try registering the in-package path so

235 // mailto still works, just from inside node_modules.

236 }

237 }

238 const __launcherExe = fs.existsSync(__rmfmailtoExe) ? __rmfmailtoExe : __pkgRmfmailtoExe;

239 if (!fs.existsSync(__launcherExe)) {

240 return { ok: false, message: `rmfmailto.exe not found at ${__launcherExe} — package may have been built without it. Re-run 'npm run build' on the build machine.` };

241 }

242 // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

243 // cmd.exe's shell layer, which strips one level before the value reaches

244 // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

245 // the EXE's argv layer.

246 const cmd = `\\"${__launcherExe}\\" \\"%1\\"`;

247 const keys = [

248 // [hive\\path, value-name, value-data]

249 [`HKCU\\Software\\Classes\\rmfmail\\shell\\open\\command`, "", cmd],

250 [`HKCU\\Software\\Classes\\rmfmail\\DefaultIcon`, "", `\\"${path.join(import.meta.dirname, "..", "client", "icon.ico")}\\",0`

251 [`HKCU\\Software\\Classes\\rmfmail`, "URL Protocol", ""],

252 [`HKCU\\Software\\Classes\\rmfmail`, "", "URL:rmfmail Protocol"],

253 // Make rmfmail visible in Settings → Default apps → Email so the

254 // user can flip it to default with one click.

255 [`HKCU\\Software\\Clients\\Mail\\rmfmail`, "", "rmfmail"],

256 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationName", "rmfmail"],

257 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationDescription", "Local-first email client"],

258 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities\\URLAssociations`, "mailto", "rmfmail"],

259 [`HKCU\\Software\\RegisteredApplications`, "rmfmail", "Software\\Clients\\Mail\\rmfmail\\Capabilities"],

260 // Belt-and-suspenders for the Win11 picker's display-name lookup:

261 // some code paths read `HKCU\Software\Classes\Applications\<exe>`

262 // for the FriendlyAppName even when the registered ProgId already