registry / @ownmail/app / 0.22.0
@ownmail/app@0.22.0
⚠ Under reviewThe customizable OwnMail web app for mail, calendar, and contacts
Static Scan Results
scanned 29d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
4 flaggedscripts/smoke-ssr.mjsView file
1import { spawn } from 'node:child_process'
L2: import { createServer } from 'node:net'
High
Child Process
Package source references child process execution.
scripts/smoke-ssr.mjsView on unpkg · L1dist/server/assets/platform-DKH1nX2U.jsView file
1import{r as Nn}from"./jsx-runtime-DE8YEWt8.js";var kn=globalThis.crypto,U=kn.subtle,Ln=Object.defineProperty,zn=(e,t)=>{for(var s in t)Ln(e,s,{get:t[s],enumerable:!0})},Pn={};zn(Pn...
L2: `);if(u=T.pop()||"",u.length>Un)throw new Error("Buffer size exceeded (1MB)");for(const I of T)if(I.startsWith("data: ")){const In=I.slice(6);e.onMessage?.(In)}}}catch(u){u instanc...
L3: local current = tonumber(redis.call('GET', KEYS[1]))
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/server/assets/platform-DKH1nX2U.jsView on unpkg · L1Findings
2 High4 Medium6 Low
HighChild Processscripts/smoke-ssr.mjs
HighSame File Env Network Executiondist/server/assets/platform-DKH1nX2U.js
MediumDynamic Requiredist-vercel/server/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/server/assets/platform-DKH1nX2U.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @ownmail/app@0.22.0.
See all versions of @ownmail/app for other recorded verdicts.
- Review the evidence and your use of @ownmail/app@0.22.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.