@ownmail/app@0.23.0
The customizable OwnMail web app for mail, calendar, and contacts
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged Unicode is a harmless zero-width skeleton placeholder, and the package has no install hook or unrelated data collection. However, sampled runtime telemetry runs by default without a user-facing opt-out, so it warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user opens the app and the root component mounts; reporting occurs on sampled loads and relevant page events.
Impact
Limited performance and error-count telemetry reaches the app operator without a user-facing disable option; no credentials, message contents, paths, or URLs are included.
Mechanism
The browser sends bounded performance metrics to the app’s authenticated, same-origin `/api/diagnostics` endpoint, where validated fields are logged with the release version.
AI rationale
The flagged Unicode is a harmless zero-width skeleton placeholder, and the package has no install hook or unrelated data collection. However, sampled runtime telemetry runs by default without a user-facing opt-out, so it warrants a warning.
Evidence
src/routes/__root.tsxsrc/app/lib/performance-monitor.tssrc/server/browser-diagnostics.tssrc/shared/lib/performance-report.ts
Network endpoints1
same-origin POST /api/diagnostics
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The app starts browser performance monitoring automatically from its root component; the monitor samples 10% of loads and posts metrics to `/api/diagnostics`.
- The README discloses the sampled, authenticated, same-origin reporting and its bounded fields, but the reviewed implementation provides no user-facing way to disable it.
- The server logs only a validated metric name, bounded numeric value, installed-app flag, and release version.
Evidence against
- The manifest has no install lifecycle hooks; its scripts are development, build, smoke-test, and test commands.
- The zero-width character in the flagged client bundle is a placeholder in an animated thread-list skeleton.
- The diagnostics payload excludes URLs and arbitrary error details; the endpoint is same-origin and requires a session.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggeddist/server/assets/platform-ycJ1qTgk.jsView file
1import{r as Nn}from"./jsx-runtime-DE8YEWt8.js";var kn=globalThis.crypto,U=kn.subtle,Ln=Object.defineProperty,Pn=(e,t)=>{for(var s in t)Ln(e,s,{get:t[s],enumerable:!0})},zn={};Pn(zn...
L2: `);if(u=T.pop()||"",u.length>Un)throw new Error("Buffer size exceeded (1MB)");for(const I of T)if(I.startsWith("data: ")){const In=I.slice(6);e.onMessage?.(In)}}}catch(u){u instanc...
L3: local current = tonumber(redis.call('GET', KEYS[1]))
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/server/assets/platform-ycJ1qTgk.jsView on unpkg · L11import{r as Nn}from"./jsx-runtime-DE8YEWt8.js";var kn=globalThis.crypto,U=kn.subtle,Ln=Object.defineProperty,Pn=(e,t)=>{for(var s in t)Ln(e,s,{get:t[s],enumerable:!0})},zn={};Pn(zn...
L2: `);if(u=T.pop()||"",u.length>Un)throw new Error("Buffer size exceeded (1MB)");for(const I of T)if(I.startsWith("data: ")){const In=I.slice(6);e.onMessage?.(In)}}}catch(u){u instanc...
L3: local current = tonumber(redis.call('GET', KEYS[1]))
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/server/assets/platform-ycJ1qTgk.jsView on unpkg · L1Findings
1 Critical3 High4 Medium6 Low
CriticalTrojan Source Unicodedist/client/assets/ThreadListSkeleton-DDwikkaI.js
HighChild Process
HighSame File Env Network Executiondist/server/assets/platform-ycJ1qTgk.js
HighSemantic Analysis Limiteddist-vercel/server/assets/router-B2cPZSWp.js#virtual:normalized:round1
MediumDynamic Requiredist-vercel/server/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/server/assets/platform-ycJ1qTgk.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @ownmail/app@0.23.0.
See all versions of @ownmail/app for other recorded verdicts.
- Review the evidence and your use of @ownmail/app@0.23.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.