registry / @ownmail/app / 0.6.1
@ownmail/app@0.6.1
The OwnMail mailbox and calendar app for Cloudflare Workers and Node hosting
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect source inspection shows a normal hosted mail/calendar application with user-triggered OAuth and mailbox operations. Flagged dynamic-import and eval-like findings are package-local server loading and Upstash Redis command APIs, not arbitrary code execution.
Static reason
No blocking static signals were detected.
Trigger
User explicitly runs or deploys the application and authenticates a mailbox.
Impact
No install-time execution, credential harvesting, foreign configuration mutation, stealth persistence, or unconsented exfiltration found.
Mechanism
Session-scoped mail API, OAuth callback, optional KV synchronization
AI rationale
Direct source inspection shows a normal hosted mail/calendar application with user-triggered OAuth and mailbox operations. Flagged dynamic-import and eval-like findings are package-local server loading and Upstash Redis command APIs, not arbitrary code execution.
Evidence
package.jsonsrc/server/nylas.tssrc/server/platform.tssrc/routes/auth.callback.tssrc/routes/api.webhooks.nylas.tsscripts/serve-node.mjsdist/server/assets/platform-CtVjpY2v.jssrc/server/session.tssrc/routes/auth.tsscripts/node-adapter.mjsdist-vercel/server/server.js
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- `package.json` has no preinstall/install/postinstall/prepare hooks or bin entry.
- `src/server/nylas.ts` scopes mailbox API access to an authenticated session grant.
- `src/server/platform.ts` validates Upstash HTTPS hosts and uses configured runtime credentials only.
- `src/routes/auth.callback.ts` performs normal PKCE OAuth token exchange without logging secrets.
- `src/routes/api.webhooks.nylas.ts` verifies signed Nylas webhooks before KV updates.
- Dynamic import in `scripts/serve-node.mjs` loads the package's local built server only; bundle `eval` references are Upstash Redis commands.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Source & flagged code
10 flaggeddist/server/assets/platform-CtVjpY2v.jsView file
3926*/
L3927: async eval(keys, args) {
L3928: await this.init(this.script);
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/server/assets/platform-CtVjpY2v.jsView on unpkg · L3926dist-vercel/server/server.jsView file
17081async function getStartManifest(matchedRoutes) {
L17082: const { tsrStartManifest } = await import("./assets/_tanstack-start-manifest_v-DqwXTmaC.js");
L17083: const startManifest = tsrStartManifest();
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-vercel/server/server.jsView on unpkg · L17081560function sanitizePathSegment(segment) {
L561: return segment.replace(PATH_UNSAFE_RE, (ch) => "%" + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0"));
L562: }
...
L4222: function formatProdErrorMessage(code) {
L4223: var url = "https://react.dev/errors/" + code;
L4224: if (1 < arguments.length) {
...
L4813: pending: false,
L4814: data: null,
L4815: method: null,
...
L18501: var SERVER_FN_BASE = "/_serverFn/";
L18502: var IS_PRERENDERING = process.env.TSS_PRERENDERING === "true";
L18503: var IS_SHELL_ENV = process.env.TSS_SHELL === "true";
Findings
1 High10 Medium8 Low
HighShips High Entropy Blob.vercel/output/static/fonts/manrope-latin.woff2
MediumDynamic Requiredist-vercel/server/server.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/server/fns.test.ts
MediumSecret Patternsrc/routes/-settings.test.tsx
LowScripts Present
LowEvaldist/server/assets/platform-CtVjpY2v.js
Affected versions and remediation
This report applies to @ownmail/app@0.6.1.
See all versions of @ownmail/app for other recorded verdicts.
- Review the evidence and your use of @ownmail/app@0.6.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.