registry / @ownmail/app / 0.5.1
@ownmail/app@0.5.1
The OwnMail mailbox and calendar app for Cloudflare Workers and Node hosting
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection shows ordinary authenticated mail/calendar functionality and generated bundle dispatch. Scanner hits for dynamic imports, eval-related Redis APIs, and binary fonts do not establish malicious behavior.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Normal authenticated application runtime actions
Impact
No unconsented install-time execution, exfiltration, persistence, destructive local action, or remote payload execution established.
Mechanism
session-scoped mailbox API calls and optional configured Redis/KV use
AI rationale
Static source inspection shows ordinary authenticated mail/calendar functionality and generated bundle dispatch. Scanner hits for dynamic imports, eval-related Redis APIs, and binary fonts do not establish malicious behavior.
Evidence
package.jsonsrc/server/nylas.tssrc/server/fns.tssrc/server/platform.tssrc/server/session.tssrc/routes/api.webhooks.nylas.tsscripts/serve-node.mjsdist-vercel/server/server.js
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook or bin entry.
- src/server/nylas.ts scopes mailbox API access to the authenticated session grant.
- src/server/fns.ts validates inputs and gates password changes behind OWNMAIL_ALLOW_PASSWORD_RESET.
- src/routes/api.webhooks.nylas.ts requires an HMAC secret and bounds webhook payloads.
- dist-vercel/server/server.js dynamic imports are generated server-function bundle dispatch, not remote code loading.
- No source evidence of credential harvesting, filesystem persistence, shell execution, or AI-agent configuration writes.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Source & flagged code
11 flaggeddist/server/assets/platform-CtVjpY2v.jsView file
3926*/
L3927: async eval(keys, args) {
L3928: await this.init(this.script);
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/server/assets/platform-CtVjpY2v.jsView on unpkg · L3926dist-vercel/server/server.jsView file
17081async function getStartManifest(matchedRoutes) {
L17082: const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-xaU4gnQn.js");
L17083: const startManifest = tsrStartManifest();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-vercel/server/server.jsView on unpkg · L17081560function sanitizePathSegment(segment) {
L561: return segment.replace(PATH_UNSAFE_RE, (ch) => "%" + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0"));
L562: }
...
L4222: function formatProdErrorMessage(code) {
L4223: var url = "https://react.dev/errors/" + code;
L4224: if (1 < arguments.length) {
...
L4813: pending: false,
L4814: data: null,
L4815: method: null,
...
L18497: var SERVER_FN_BASE = "/_serverFn/";
L18498: var IS_PRERENDERING = process.env.TSS_PRERENDERING === "true";
L18499: var IS_SHELL_ENV = process.env.TSS_SHELL === "true";
Findings
2 High10 Medium8 Low
HighShips High Entropy Blob.vercel/output/static/fonts/manrope-latin.woff2
HighPrevious Version Dangerous Deltadist-vercel/server/assets/mail.compose-DvFZZOLQ.js
MediumDynamic Requiredist-vercel/server/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/routes/-settings.test.tsx
Low
Affected versions and remediation
This report applies to @ownmail/app@0.5.1.
See all versions of @ownmail/app for other recorded verdicts.
- Review the evidence and your use of @ownmail/app@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.