registry / @ownmail/app / 0.5.2
@ownmail/app@0.5.2
The OwnMail mailbox and calendar app for Cloudflare Workers and Node hosting
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect inspection shows a deployable OwnMail application with explicit Nylas OAuth, authenticated mailbox operations, signed sessions, and verified webhooks. Scanner findings map to bundled dependencies, normal platform imports, and application network use rather than a concrete malicious chain.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User deploys or explicitly runs the OwnMail application.
Impact
Handles configured Nylas mailbox data for the authenticated session; no unconsented execution or exfiltration behavior found.
Mechanism
Authenticated OwnMail mailbox, calendar, webhook, and attachment service.
AI rationale
Direct inspection shows a deployable OwnMail application with explicit Nylas OAuth, authenticated mailbox operations, signed sessions, and verified webhooks. Scanner findings map to bundled dependencies, normal platform imports, and application network use rather than a concrete malicious chain.
Evidence
package.jsonsrc/server/platform.tssrc/server/nylas.tssrc/server/session.tssrc/server/fns.tssrc/routes/auth.tssrc/routes/auth.callback.tssrc/routes/api.webhooks.nylas.tssrc/routes/attachments.$attachmentId.tsscripts/serve-node.mjsscripts/node-adapter.mjsscripts/capture-readme-screenshots.mjsvite.config.tsvite.config.local.tsvite.config.vercel.ts.vercel/output/config.json
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall, install, postinstall, prepare, bin, or executable entrypoint.
- src/server/platform.ts only dynamically imports the platform-provided cloudflare:workers module and validates optional Upstash URLs to HTTPS *.upstash.io.
- src/routes/auth.ts and src/routes/auth.callback.ts implement explicit Nylas OAuth PKCE and session creation.
- src/routes/api.webhooks.nylas.ts verifies Nylas HMAC webhooks before scoped KV version updates.
- src/routes/attachments.$attachmentId.ts proxies only authenticated users' requested mailbox attachments.
- scripts/serve-node.mjs is an explicit localhost-only development server with path traversal checks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
Source & flagged code
11 flaggeddist/server/assets/platform-CtVjpY2v.jsView file
3926*/
L3927: async eval(keys, args) {
L3928: await this.init(this.script);
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/server/assets/platform-CtVjpY2v.jsView on unpkg · L3926dist-vercel/server/server.jsView file
17081async function getStartManifest(matchedRoutes) {
L17082: const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-Bc8xZxWo.js");
L17083: const startManifest = tsrStartManifest();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-vercel/server/server.jsView on unpkg · L17081560function sanitizePathSegment(segment) {
L561: return segment.replace(PATH_UNSAFE_RE, (ch) => "%" + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0"));
L562: }
...
L4222: function formatProdErrorMessage(code) {
L4223: var url = "https://react.dev/errors/" + code;
L4224: if (1 < arguments.length) {
...
L4813: pending: false,
L4814: data: null,
L4815: method: null,
...
L18501: var SERVER_FN_BASE = "/_serverFn/";
L18502: var IS_PRERENDERING = process.env.TSS_PRERENDERING === "true";
L18503: var IS_SHELL_ENV = process.env.TSS_SHELL === "true";
Findings
2 High10 Medium8 Low
HighShips High Entropy Blob.vercel/output/static/fonts/manrope-latin.woff2
HighPrevious Version Dangerous Deltadist-vercel/client/assets/mail.compose-Cn5cTjlx.js
MediumDynamic Requiredist-vercel/server/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/routes/-settings.test.tsx
Low
Affected versions and remediation
This report applies to @ownmail/app@0.5.2.
See all versions of @ownmail/app for other recorded verdicts.
- Review the evidence and your use of @ownmail/app@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.