@bobfrankston/rmfmail@1.2.128

Analysis

@bobfrankston/rmfmail is an email client that depends on multiple packages from the same publisher that are known to be malicious: @bobfrankston/iflow-direct, @bobfrankston/mailx-imap, @bobfrankston/mailx-sync, @bobfrankston/msger, @bobfrankston/oauthsupport, @bobfrankston/rmf-tiny, and @bobfrankston/tcp-transport. A prior version of @bobfrankston/rmfmail was confirmed as a supply-chain attack. The postinstall hook (node bin/postinstall.js) creates workspace symlinks; the package ships a native Windows PE binary (bin/rmfmailto.exe) for mailto: handler registration; and the daemon spawns detached background sync workers. The malicious behaviour is delivered through the dependency chain to the publisher's own known-malware packages.