@bobfrankston/rmfmail@1.2.211

Analysis

The package @bobfrankston/rmfmail is a trojanized email client that exfiltrates browser credential stores. At install time, the postinstall hook (bin/postinstall.js) triggers a dependency chain that accesses WebView2 browser credential files (EBWebView/Default/Login Data) via a bundled native executable (msgernative.exe). The package ships multiple PE executables (rmfmailto.exe, rmfshare.exe), uses detached subprocesses for persistence, and contains a remote-fetch-to-exec pattern in client/app.bundle.js that fetches and evaluates remote code. DNS sinkhole queries were observed during execution. The package depends on 9 known-malicious @bobfrankston/* packages that form the credential-theft pipeline.