@bobfrankston/rmfmail@1.2.312: Malicious npm security report

Loading npm security reports…

@bobfrankston/rmfmail@1.2.312: Malicious npm security report | LPM Firewall

Source & flagged code

24 flagged

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

5Cross-file remote execution chain: bin/build-bundles.mjs spawns client/android-bootstrap.bundle.js; helper contains network access plus dynamic code execution. L5: * mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAcce

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

242// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

707// session — inherits it. On Windows a process's cwd holds the directory L708: // locked, so `npm install -g` (the in-app self-update AND a manual update) L709: // dies with EBUSY renaming .../rmfmail/bin for as long as we run ... L720: if (!verbose && !isDaemon && !process.argv.slice(2).some(a => /^-/.test(a))) { L721: const { spawn } = await import("node:child_process"); L722: const child = spawn(process.execPath, [...process.argv.slice(1), "--daemon"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = bin/mailx.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

12096try { L12097: const fn = new Function(`return (async () => (${code}))();`); L12098: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12096

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = bin/share-target.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = bin/share-target.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = client/android-bootstrap.bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = client/lib/local-service.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/paste-markdown.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = client/compose/paste-markdown.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.jsView on unpkg

client/compose/paste-markdown.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = client/compose/paste-markdown.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.tsView on unpkg

client/compose/spellcheck-core.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = client/compose/spellcheck-core.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.310 matchedPath = client/compose/spellcheck-core.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.310 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

12096try { L12097: const fn = new Function(`return (async () => (${code}))();`); L12098: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12096

bin/lean-accounts.jsView file

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

packages/mailx-store-web/worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

packages/mailx-store-web/worker-entry.tsView on unpkg · L37

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/paste-markdown.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.jsView on unpkg

client/compose/paste-markdown.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.tsView on unpkg

client/compose/spellcheck-core.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

Source & flagged code

24 flagged

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

12096try { L12097: const fn = new Function(`return (async () => (${code}))();`); L12098: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12096

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/paste-markdown.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.jsView on unpkg

client/compose/paste-markdown.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/paste-markdown.tsView on unpkg

client/compose/spellcheck-core.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

@bobfrankston/rmfmail@1.2.312

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code