registry / @ownmail/app / 0.19.0
@ownmail/app@0.19.0
⚠ Under reviewThe customizable OwnMail web app for mail, calendar, and contacts
Static Scan Results
scanned 1mo ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
4 flaggedscripts/smoke-ssr.mjsView file
1import { spawn } from 'node:child_process'
L2: import { createServer } from 'node:net'
High
Child Process
Package source references child process execution.
scripts/smoke-ssr.mjsView on unpkg · L11import { spawn } from 'node:child_process'
L2: import { createServer } from 'node:net'
L3: import { dirname, join } from 'node:path'
...
L13: env: {
L14: ...process.env,
L15: APP_NAME: 'ownmail-ssr-smoke',
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/smoke-ssr.mjsView on unpkg · L1dist/server/assets/platform-BgKBpIdD.jsView file
3707*/
L3708: async eval(keys, args) {
L3709: await this.init(this.script);
Low
Findings
2 High4 Medium6 Low
HighChild Processscripts/smoke-ssr.mjs
HighSame File Env Network Executionscripts/smoke-ssr.mjs
MediumDynamic Requiredist-vercel/server/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/server/assets/platform-BgKBpIdD.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @ownmail/app@0.19.0.
See all versions of @ownmail/app for other recorded verdicts.
- Review the evidence and your use of @ownmail/app@0.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.