@bobfrankston/rmfmail@1.2.364

Analysis

@bobfrankston/rmfmail@1.2.364 declares as runtime dependencies three package versions that carry known malicious payloads and installs them alongside itself: @bobfrankston/mailx-host@0.1.15, @bobfrankston/oauthsupport@1.0.35 and @bobfrankston/tcp-transport@0.1.8 (ranges ^0.1.15, ^1.0.35 and ^0.1.8 in the manifest). Installing rmfmail therefore pulls those versions into the dependency tree, where their code is resolved and required at runtime by the client's mail service and OAuth handling. This advisory is metadata-only with respect to rmfmail itself: no network endpoints, dropped files, or credential-harvesting behaviour were identified in rmfmail's own shipped files, whose lifecycle hook (bin/postinstall.js) only checks the Node version and creates workspace symlinks. Consumers should pin or remove the three flagged dependency versions. No IOCs are listed for the rmfmail package itself because none were observed in it.