Loading npm security reports…

@bobfrankston/rmfmail@1.2.239: Malicious npm security report | LPM Firewall

registry / @bobfrankston/rmfmail / 1.2.239

@bobfrankston/rmfmail@1.2.239

Local-first email client with IMAP sync and standalone native app

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The Android mail client automatically transmits verbose account and sync diagnostics to an unrelated hard-coded host. Account identity and mail-server configuration are sent without a user-controlled telemetry setting.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Launching and initializing the Android client with configured accounts.

Impact

Unconsented exfiltration of email-account metadata and potentially sensitive error details to a third party.

Mechanism

Automatic remote diagnostic logging of account metadata and errors.

Attack narrative

On Android startup, the bundled bootstrap initializes mail accounts and invokes vlog with the account email, ID, IMAP host/auth, and serialized IMAP configuration. vlog sends up to 800 characters to the hard-coded rmf39.aaz.lt logging endpoint. Sync paths also send account identifiers and exception text. This is automatic telemetry to an unrelated endpoint with no visible consent or opt-out control.

Rationale

Source establishes an automatic external transmission of user mail-account metadata, not merely package-aligned mail-provider traffic. The benign lifecycle hook and loopback MCP server do not mitigate that concrete exfiltration path.

Evidence

package.jsonbin/postinstall.jsbin/mcp-server.jspackages/mailx-store-web/android-bootstrap.jspackages/mailx-store-web/sync-manager.jspackages/mailx-store-web/worker-entry.js

Network endpoints1

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/mailx.jsView file

54import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo";

High

Child Process

Package source references child process execution.

bin/mailx.jsView on unpkg · L54

242// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

53Cross-file remote execution chain: bin/mailx.js spawns bin/popout-server.js; helper contains network access plus dynamic code execution. L53: import os from "node:os"; L54: import net from "node:net"; L55: import { execSync } from "node:child_process"; L56: import { ports } from "@bobfrankston/miscinfo"; ... L221: // (shipped in the npm package) to the per-app location below. L222: const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin"); L223: const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe"); ... L242: // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before ... L380: // Linux pickers

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/mailx.jsView on unpkg · L53

641// session — inherits it. On Windows a process's cwd holds the directory L642: // locked, so `npm install -g` (the in-app self-update AND a manual update) L643: // dies with EBUSY renaming .../rmfmail/bin for as long as we run ... L654: if (!verbose && !isDaemon && !process.argv.slice(2).some(a => /^-/.test(a))) { L655: const { spawn } = await import("node:child_process"); L656: const child = spawn(process.execPath, [...process.argv.slice(1), "--daemon"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L641

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.226 matchedPath = bin/mailx.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.226 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

11216try { L11217: const fn = new Function(`return (async () => (${code}))();`); L11218: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11216

bin/lean-accounts.jsView file

137package = @bobfrankston/rmfmail; repositoryIdentity = mailx; dependency = jsonc-parser L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null); L139: if (mod) { parseJsonc = mod.parse; break; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/lean-accounts.jsView on unpkg · L137

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

bin/build-bundles.mjsView file

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L148: logLevel: "info", L149: // .wasm files are inlined as base64 data URLs so the runtime can L150: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L151: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L152: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.226 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.226 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.226 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.226 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.226 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.226 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

packages/mailx-service/index.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.241 matchedPath = packages/mailx-service/index.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.241 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

27 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmfshare-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

31 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.65",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.147",

38 "@bobfrankston/mailx-store-web": "^0.1.76",

39 "@bobfrankston/mailx-sync": "^0.1.29",

40 "@bobfrankston/miscinfo": "^1.0.16",

41 "@bobfrankston/msger": "^0.1.422",

42 "@bobfrankston/node-tcp-transport": "^0.1.10",

43 "@bobfrankston/oauthsupport": "^1.0.34",

44 "@bobfrankston/rmf-tiny": "^0.1.45",

45 "@bobfrankston/smtp-direct": "^0.1.9",

46 "@bobfrankston/tcp-transport": "^0.1.8",

47 "@capacitor/android": "^8.3.0",

48 "@capacitor/cli": "^8.3.0",

49 "@capacitor/core": "^8.3.0",

50 "dictionary-en": "^4.0.0",

51 "express": "^4.21.0",

52 "harper.js": "^2.4.0",

bin/mailx.jsView file

Lines 34-74javascript

34 * configured accounts. Falls back to the first

35 * "override" account (non-known-provider domain).

36 * rmfmail -send <file> -account

client/app.bundle.jsView file

11216try { L11217: const fn = new Function(`return (async () => (${code}))();`); L11218: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11216

bin/lean-accounts.jsView file

Lines 116-157javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

bin/build-bundles.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

8 * pulling in transitive deps, the WebView is paying that cost N times in

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.226 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.226 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.226 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.226 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.226 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.226 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

packages/mailx-service/index.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.241 matchedPath = packages/mailx-service/index.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.241 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/mailx-service/index.jsView on unpkg

Lines 222-262javascript

222 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

223 const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe");

224 const __pkgRmfmailtoExe = path.join(import.meta.dirname, "rmfmailto.exe");

225 if (fs.existsSync(__pkgRmfmailtoExe) && (!fs.existsSync(__rmfmailtoExe) ||

226 fs.statSync(__pkgRmfmailtoExe).mtimeMs > fs.statSync(__rmfmailtoExe).mtimeMs)) {

227 try {

228 fs.mkdirSync(__perAppBin, { recursive: true });

229 fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe);

230 lines.push(`Installed rmfmailto.exe to ${__rmfmailtoExe}`);

231 }

232 catch (e) {

233 lines.push(`Failed to copy rmfmailto.exe to per-app dir: ${e.message}`);

234 // Fall through and try registering the in-package path so

235 // mailto still works, just from inside node_modules.

236 }

237 }

238 const __launcherExe = fs.existsSync(__rmfmailtoExe) ? __rmfmailtoExe : __pkgRmfmailtoExe;

239 if (!fs.existsSync(__launcherExe)) {

240 return { ok: false, message: `rmfmailto.exe not found at ${__launcherExe} — package may have been built without it. Re-run 'npm run build' on the build machine.` };

241 }

242 // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

243 // cmd.exe's shell layer, which strips one level before the value reaches

244 // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

245 // the EXE's argv layer.

246 const cmd = `\\"${__launcherExe}\\" \\"%1\\"`;

247 const keys = [

248 // [hive\\path, value-name, value-data]

249 [`HKCU\\Software\\Classes\\rmfmail\\shell\\open\\command`, "", cmd],

250 [`HKCU\\Software\\Classes\\rmfmail\\DefaultIcon`, "", `\\"${path.join(import.meta.dirname, "..", "client", "icon.ico")}\\",0`

251 [`HKCU\\Software\\Classes\\rmfmail`, "URL Protocol", ""],

252 [`HKCU\\Software\\Classes\\rmfmail`, "", "URL:rmfmail Protocol"],

253 // Make rmfmail visible in Settings → Default apps → Email so the

254 // user can flip it to default with one click.

255 [`HKCU\\Software\\Clients\\Mail\\rmfmail`, "", "rmfmail"],

256 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationName", "rmfmail"],

257 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationDescription", "Local-first email client"],

258 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities\\URLAssociations`, "mailto", "rmfmail"],

259 [`HKCU\\Software\\RegisteredApplications`, "rmfmail", "Software\\Clients\\Mail\\rmfmail\\Capabilities"],

260 // Belt-and-suspenders for the Win11 picker's display-name lookup:

261 // some code paths read `HKCU\Software\Classes\Applications\<exe>`

262 // for the FriendlyAppName even when the registered ProgId already