
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
Modern and easy-to-use IMAP client library for Node.js.
ImapFlow provides a clean, promise-based API for working with IMAP, so you don't need in-depth knowledge of the protocol. IMAP extensions are detected and handled automatically. You write the same code regardless of server capabilities, and ImapFlow adapts behind the scenes. ImapFlow is the IMAP engine that powers EmailEngine, a self-hosted email API built by the same team.
import { ImapFlow } from 'imapflow' and const { ImapFlow } = require('imapflow') both worknpm install imapflow
ImapFlow requires Node.js 20 or newer. The package ships both an ES module build and a CommonJS build with bundled type declarations, so no separate @types package is needed.
The ES module build also runs on Bun (tested against the latest release) and on Cloudflare Workers with the nodejs_compat compatibility flag. On Workers connect with implicit TLS (secure: true, usually port 993) or in cleartext: the runtime can not upgrade an already connected socket, so a STARTTLS negotiation fails with a TLS error, and it does not allow turning certificate validation off, so tls: { rejectUnauthorized: false } is rejected with ERR_OPTION_NOT_IMPLEMENTED. COMPRESS=DEFLATE, IDLE and the default pino logger work as on Node.js.
import { ImapFlow } from 'imapflow';
// or in CommonJS: const { ImapFlow } = require('imapflow');
const client = new ImapFlow({
host: 'imap.example.com',
port: 993,
secure: true,
auth: {
user: 'user@example.com',
pass: 'password'
}
});
const main = async () => {
await client.connect();
let lock = await client.getMailboxLock('INBOX');
try {
// fetch latest message
let message = await client.fetchOne(client.mailbox.exists, { source: true });
console.log(message.source.toString());
// list subjects for all messages
for await (let message of client.fetch('1:*', { envelope: true })) {
console.log(`${message.uid}: ${message.envelope.subject}`);
}
} finally {
// always release the lock
lock.release();
}
await client.logout();
};
main().catch(console.error);
See the Quick Start guide for more examples, including Gmail, Outlook, and Yahoo configuration.
Full documentation is available at imapflow.com.
ImapFlow was built for EmailEngine, a self-hosted email API that turns Gmail, Microsoft 365, and IMAP accounts into REST endpoints, with managed OAuth2 and webhooks for incoming mail. If you need a production email integration rather than an IMAP client, start there.
Copyright (c) 2020-2025 Postal Systems OU
Licensed under the MIT license.
The 'imap' package is a simple and straightforward IMAP client for Node.js. It provides basic functionalities for connecting to an IMAP server and managing emails. Compared to ImapFlow, it is less feature-rich and may not handle large volumes of emails as efficiently.
Mailparser is a package focused on parsing email content rather than managing IMAP connections. It can be used in conjunction with other IMAP clients to process email data. While ImapFlow handles both connection and parsing, Mailparser specializes in the latter.
Node-imap is another popular IMAP client for Node.js. It offers a range of features for interacting with email servers. While it is similar to ImapFlow in terms of functionality, ImapFlow is designed to be more efficient and modern, with better support for handling large mailboxes.
FAQs
IMAP Client for Node
The npm package imapflow receives a total of 1,495,759 weekly downloads. As such, imapflow popularity was classified as popular.
We found that imapflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.