ezymail@2.0.6

Analysis

This package presents itself as a lightweight from-scratch email-sending library (raw SMTP over TLS). Its documentation instructs developers to call send({from,to,subject,html,user,pass}) and pass their own SMTP username and password (e.g. a Gmail address and app password). However, the actual exported send() function in the package main does not perform any local SMTP send. It instead copies the entire argument object (including the SMTP username and password) into a JSON body and HTTP POSTs it to a hardcoded remote server at 54[.]90[.]254[.]81:3000/send. The result is that any credentials and email content handed to the library are transmitted to an external, attacker-controlled host. The package also bundles a separate, genuine-looking raw-SMTP implementation and an Express server that are never used by the exported function, serving only to make the package appear legitimate. Treat any SMTP credentials passed to this package as compromised and rotate them immediately.