
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
Modern and easy-to-use IMAP client library for Node.js.
ImapFlow provides a clean, promise-based API for working with IMAP, so you don't need in-depth knowledge of the protocol. IMAP extensions are detected and handled automatically. You write the same code regardless of server capabilities, and ImapFlow adapts behind the scenes. ImapFlow is the IMAP engine that powers EmailEngine, a self-hosted email API built by the same team.
import { ImapFlow } from 'imapflow' and const { ImapFlow } = require('imapflow') both worknpm install imapflow
ImapFlow requires Node.js 20 or newer. The package ships both an ES module build and a CommonJS build with bundled type declarations, so no separate @types package is needed.
The ES module build also runs on Bun (tested against the latest release) and on Cloudflare Workers with the nodejs_compat compatibility flag. On Workers connect with implicit TLS (secure: true, usually port 993) or in cleartext: the runtime can not upgrade an already connected socket, so a STARTTLS negotiation fails with a TLS error, and it does not allow turning certificate validation off, so tls: { rejectUnauthorized: false } is rejected with ERR_OPTION_NOT_IMPLEMENTED. COMPRESS=DEFLATE, IDLE and the default pino logger work as on Node.js.
import { ImapFlow } from 'imapflow';
// or in CommonJS: const { ImapFlow } = require('imapflow');
const client = new ImapFlow({
host: 'imap.example.com',
port: 993,
secure: true,
auth: {
user: 'user@example.com',
pass: 'password'
}
});
const main = async () => {
await client.connect();
let lock = await client.getMailboxLock('INBOX');
try {
// fetch latest message
let message = await client.fetchOne(client.mailbox.exists, { source: true });
console.log(message.source.toString());
// list subjects for all messages
for await (let message of client.fetch('1:*', { envelope: true })) {
console.log(`${message.uid}: ${message.envelope.subject}`);
}
} finally {
// always release the lock
lock.release();
}
await client.logout();
};
main().catch(console.error);
See the Quick Start guide for more examples, including Gmail, Outlook, and Yahoo configuration.
Full documentation is available at imapflow.com.
ImapFlow was built for EmailEngine, a self-hosted email API that turns Gmail, Microsoft 365, and IMAP accounts into REST endpoints, with managed OAuth2 and webhooks for incoming mail. If you need a production email integration rather than an IMAP client, start there.
Copyright (c) 2020-2025 Postal Systems OU
Licensed under the MIT license.
The 'imap' package is a simple and straightforward IMAP client for Node.js. It provides basic functionalities for connecting to an IMAP server and managing emails. Compared to ImapFlow, it is less feature-rich and may not handle large volumes of emails as efficiently.
Mailparser is a package focused on parsing email content rather than managing IMAP connections. It can be used in conjunction with other IMAP clients to process email data. While ImapFlow handles both connection and parsing, Mailparser specializes in the latter.
Node-imap is another popular IMAP client for Node.js. It offers a range of features for interacting with email servers. While it is similar to ImapFlow in terms of functionality, ImapFlow is designed to be more efficient and modern, with better support for handling large mailboxes.
FAQs
IMAP Client for Node
The npm package imapflow receives a total of 1,608,038 weekly downloads. As such, imapflow popularity was classified as popular.
We found that imapflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.