
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Check that email addresses are really able to accept emails by pinging the DNS and checking for active MX records.
BREAKING CHANGE NOTICE (v2.0.0): Legit has been migrated to TypeScript. This introduces a breaking change in how the module is imported. Please update your code to use ES module imports (import legit from 'legit'
) instead of require
.
A wrapper for the NodeJS Dns.resolveMx method that checks the domain of an email address for valid/existence of MX records.
$ npm install legit
import legit from "legit";
legit("validemail@validdomain.com")
.then((result) => {
result.isValid ? console.log("Valid!") : console.log("Invalid!");
console.log(JSON.stringify(result));
})
.catch((err) => console.log(err));
If an email domain is legit then the object returned will include an isValid
key that will be set to true
as well as an mxArray
key with all the MX record information for the valid domain.
If the domain has no MX or cannot resolve any MX then it will return isValid
as false
.
Anything else is considered an error and you'll get it in the .catch
For a more modern approach using ES6, you can await
the response before acting on it.
import legit from "legit";
(async () => {
try {
const response = await legit("validemail@validdomain.com");
response.isValid ? console.log("valid") : console.log("invalid");
} catch (e) {
console.log(e);
}
})();
For a valid email address, you'll get the following response object:
{
"isValid": true,
"mxArray": [
{
"exchange": "aspmx.l.google.com",
"priority": 1
},
{
"exchange": "alt1.aspmx.l.google.com",
"priority": 5
},
{
"exchange": "alt2.aspmx.l.google.com",
"priority": 5
},
{
"exchange": "alt3.aspmx.l.google.com",
"priority": 10
},
{
"exchange": "alt4.aspmx.l.google.com",
"priority": 10
}
]
}
(The MIT License)
Copyright (c) 2015-2025 Martyn Davies, and contributors.
FAQs
Check that email addresses are really able to accept emails by pinging the DNS and checking for active MX records.
We found that legit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.