@bobfrankston/rmfmail
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | rapid-publish | AI (publish-pattern): Publisher has 337 versions with automated rapid publishing; consistent pattern for this active project. | ai | |
| phantom-deps | phantom-dep:@bobfrankston/mailx-store-web | AI (phantom-deps): Same-org scoped package; phantom-dep heuristic false positive for this package. | ai | |
| source-diff | encoded-string-file:client/android-bootstrap.bundle.js | AI (source-diff): Encoded string is sql-wasm.wasm bundled as base64 via sql.js — standard legitimate pattern. | ai | |
| phantom-deps | phantom-dep:@bobfrankston/rmf-tiny | AI (phantom-deps): Same-org scoped package; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:dictionary-en | AI (phantom-deps): Declared but config-only; same-org package pattern, stable false positive. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Vendored TinyMCE assets and bundle; expected for this email client package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Growth from adding TinyMCE and related editor deps; expected. | ai | |
| source-diff | obfuscated-file:client/android-bootstrap.bundle.js | AI (source-diff): esbuild-style bundle for Android client; standard bundler output pattern. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): rmfmailto.exe is the package's own mailto: handler binary; present across many versions. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires inside bundled Quill editor (quill.js line 2); standard minified library pattern. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/tinymce-5/content.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/oxide-dark/content.inline.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/oxide/content.inline.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/tinymce-5-dark/content.inline.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/tinymce-5/content.inline.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/oxide-dark/content.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/oxide/content.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/skins/ui/tinymce-5-dark/content.js | AI (source-diff): Standard TinyMCE vendored skin file; minified CSS-in-JS is expected for this library. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/plugins/emoticons/js/emojiimages.js | AI (source-diff): Standard TinyMCE vendored emoji data file; large minified data is expected. | ai | |
| source-diff | obfuscated-file:client/lib/tinymce/plugins/emoticons/js/emojis.js | AI (source-diff): Standard TinyMCE vendored emoji data file; large minified data is expected. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs a local node script with no network or shell exec; benign setup pattern for this package. | ai | |
| phantom-deps | phantom-dep:@capacitor/android | AI (phantom-deps): Capacitor deps referenced in config only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@capacitor/core | AI (phantom-deps): Capacitor deps referenced in config only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@capacitor/cli | AI (phantom-deps): Capacitor deps referenced in config only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:quill | AI (phantom-deps): Referenced in config files only; stable false positive for this package. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP is 127.0.0.1 in a console.log message directing users to local UI; not an outbound network request. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 1.1.186 | 27 / 3 | |
| 1.1.159 | 27 / 3 | |
| 1.1.158 | 27 / 3 | |
| 1.1.156 | 27 / 3 | |
| 1.1.131 | 27 / 3 | |
| 1.1.106 | 27 / 3 | |
| 1.1.75 | 27 / 3 | |
| 1.1.33 | 27 / 3 | |
| 1.1.32 | 27 / 3 | |
| 1.1.31 | 27 / 3 | |
| 1.0.705 | 27 / 3 | |
| 1.0.542 | 22 / 1 | |
| 1.0.500 | 20 / 1 | |
| 1.0.499 | 20 / 1 | |
| 1.0.492 | 20 / 1 | |
| 1.0.487 | 20 / 1 | |
| 1.0.486 | 20 / 1 | |
| 1.0.484 | 20 / 1 | |
| 1.0.479 | 20 / 1 | |
| 1.0.476 | 20 / 1 | |
| 1.0.475 | 20 / 1 | |
| 1.0.473 | 20 / 1 | |
| 1.0.472 | 20 / 1 | |
| 1.0.470 | 20 / 1 | |
| 1.0.469 | 21 / 1 |
v1.1.186
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.159
3 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.158
3 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.156
3 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.131
3 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.106
3 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.75
13 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.33
13 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.32
13 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.31
13 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.705
12 findingsPackage contains compiled binaries that could be backdoors: • bin/rmfmailto.exe
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.542
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.500
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.499
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.492
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.487
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.486
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.484
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.479
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.476
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.475
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.473
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.472
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.470
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.469
2 findingsScript: node bin/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.