@bobfrankston/rmfmail@1.2.259: Malicious npm security report | LPM Firewall

Loading npm security reports…

@bobfrankston/rmfmail@1.2.259: Malicious npm security report | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

5Cross-file remote execution chain: bin/build-bundles.mjs spawns client/app.bundle.js; helper contains network access plus dynamic code execution. L5: * mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

242// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/mailx.js: fs.copyFileSync(file, target); fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe); // mailto still works, just from inside node_modules. // picker show "rmfmail" regardless of which path it follows. // Exec quoting follows the Desktop Entry spec: quoted absolute paths, fs.writeFileSync(desktopPath, desktopEntry); fs.writeFileSync(__instanceFile, JSON.stringify(payload, null, 2)); fs.writeFileSync(__handoffStamp, String(Date.now()));

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/mailx.jsView on unpkg

661// session — inherits it. On Windows a process's cwd holds the directory L662: // locked, so `npm install -g` (the in-app self-update AND a manual update) L663: // dies with EBUSY renaming .../rmfmail/bin for as long as we run ... L674: if (!verbose && !isDaemon && !process.argv.slice(2).some(a => /^-/.test(a))) { L675: const { spawn } = await import("node:child_process"); L676: const child = spawn(process.execPath, [...process.argv.slice(1), "--daemon"], {

High

Runtime Package Install

client/app.bundle.jsView file

11468try { L11469: const fn = new Function(`return (async () => (${code}))();`); L11470: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11468

bin/lean-accounts.jsView file

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/share-target.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

27 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmfshare-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

31 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.65",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.153",

38 "@bobfrankston/mailx-store-web": "^0.1.80",

39 "@bobfrankston/mailx-sync": "^0.1.29",

40 "@bobfrankston/miscinfo": "^1.0.17",

41 "@bobfrankston/msger": "^0.1.425",

42 "@bobfrankston/node-tcp-transport": "^0.1.10",

43 "@bobfrankston/oauthsupport": "^1.0.34",

44 "@bobfrankston/rmf-tiny": "^0.1.49",

45 "@bobfrankston/smtp-direct": "^0.1.9",

46 "@bobfrankston/tcp-transport": "^0.1.8",

47 "@capacitor/android": "^8.3.0",

48 "@capacitor/cli": "^8.3.0",

49 "@capacitor/core": "^8.3.0",

50 "dictionary-en": "^4.0.0",

51 "express": "^4.21.0",

52 "harper.js": "^2.4.0",

bin/build-bundles.mjsView file

Lines 1-51javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

8 * pulling in transitive deps, the WebView is paying that cost N times in

9 * series.

10 *

bin/mailx.jsView file

Lines 222-262javascript

222 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

223 const __rmfmailtoExe = path.join

client/app.bundle.jsView file

11468try { L11469: const fn = new Function(`return (async () => (${code}))();`); L11470: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11468

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.254 matchedPath = bin/share-target.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.254 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg