
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@zigvycorp/mail-listner
Advanced tools
Mail listener library for node.js. Get notification when new email arrived.
Mail-listener2 library for node.js. Get notification when new email arrived to inbox or when message metadata (e.g. flags) changes externally. Uses IMAP protocol.
We are using these libraries: node-imap, mailparser.
Heavily inspired by mail-listener.
Install
npm install mail-listener2
JavaScript Code:
var MailListener = require("mail-listener2");
var mailListener = new MailListener({
username: "imap-username",
password: "imap-password",
host: "imap-host",
port: 993, // imap port
tls: true,
connTimeout: 10000, // Default by node-imap
authTimeout: 5000, // Default by node-imap,
debug: console.log, // Or your custom function with only one incoming argument. Default: null
tlsOptions: { rejectUnauthorized: false },
mailbox: "INBOX", // mailbox to monitor
searchFilter: ["UNSEEN", "FLAGGED"], // the search filter being used after an IDLE notification has been retrieved
markSeen: true, // all fetched email willbe marked as seen and not fetched next time
fetchUnreadOnStart: true, // use it only if you want to get all unread email on lib start. Default is `false`,
mailParserOptions: {streamAttachments: true}, // options to be passed to mailParser lib.
attachments: true, // download attachments as they are encountered to the project directory
attachmentOptions: { directory: "attachments/" } // specify a download directory for attachments
});
mailListener.start(); // start listening
// stop listening
//mailListener.stop();
mailListener.on("server:connected", function(){
console.log("imapConnected");
});
mailListener.on("server:disconnected", function(){
console.log("imapDisconnected");
});
mailListener.on("error", function(err){
console.log(err);
});
mailListener.on("mail", function(mail, seqno, attributes){
// do something with mail object including attachments
console.log("emailParsed", mail);
// mail processing code goes here
});
mailListener.on("attachment", function(attachment){
console.log(attachment.path);
});
// it's possible to access imap object from node-imap library for performing additional actions. E.x.
mailListener.imap.move(:msguids, :mailboxes, function(){})
That's easy!
Attachments can be streamed or buffered. This feature is based on how mailparser handles attachments.
Setting attachments: true
will download attachments as buffer objects by default to the project directory.
A specific download directory may be specified by setting attachmentOptions: { directory: "attachments/"}
.
Attachments may also be streamed using attachmentOptions: { stream: "true"}
. The "attachment"
event will be fired every time an attachment is encountered.
Refer to the mailparser docs for specifics on how to stream attachments.
MIT
FAQs
Mail listener library for node.js. Get notification when new email arrived.
The npm package @zigvycorp/mail-listner receives a total of 3 weekly downloads. As such, @zigvycorp/mail-listner popularity was classified as not popular.
We found that @zigvycorp/mail-listner demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.