Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
postal-mime
Advanced tools
Email parser for browser and serverless environments.
PostalMime can be run in the main web thread or from Web Workers. It can also be used in serverless functions like Cloudflare Email Workers.
[!TIP] PostalMime is developed by the makers of EmailEngine – a self-hosted email gateway that allows making REST requests against IMAP and SMTP servers. EmailEngine also sends webhooks whenever something changes on the registered accounts.
The source code is available on GitHub.
See this example.
First, install the module from npm:
$ npm install postal-mime
Next, import the PostalMime class into your script:
import PostalMime from './node_modules/postal-mime/src/postal-mime.js';
Or when using it from a Node.js app or in a serverless function:
import PostalMime from 'postal-mime';
PostalMime methods use Promises, so you need to wait using await
or the then()
method to get the response.
import PostalMime from './node_modules/postal-mime/src/postal-mime.js';
const email = await PostalMime.parse(`Subject: My awesome email 🤓
Content-Type: text/html; charset=utf-8
<p>Hello world 😵💫</p>`);
console.log(email.subject);
It is pretty much the same as in the browser.
import PostalMime from 'postal-mime';
import util from 'node:util';
const email = await PostalMime.parse(`Subject: My awesome email 🤓
Content-Type: text/html; charset=utf-8
<p>Hello world 😵💫</p>`);
console.log(util.inspect(email, false, 22, true));
Pretty much the same as in Node.js. Use message.raw
as the raw message for parsing.
import PostalMime from 'postal-mime';
export default {
async email(message, env, ctx) {
const email = await PostalMime.parse(message.raw);
console.log('Subject: ', email.subject);
console.log('HTML: ', email.html);
console.log('Text: ', email.text);
}
};
parse(email, options)
is a static class method used to parse emails.
PostalMime.parse(email, options) -> Promise
Where:
false
). If set to true
, then treats message/rfc822
attachments without a Content-Disposition declaration as attachments. By default, these messages are treated as inline values.false
). If set to true
, then treats all message/rfc822
nodes as attachments.This method parses an email message into a structured object with the following properties:
"dkim-signature"
.null
if disposition was not provided.Parse email address strings.
addressParser(addressStr, opts) -> Array
Where:
true
, it ignores address groups and returns a flat array of addresses. By default (flatten
is false
), the result might include nested groups.The result is an array of objects:
flatten
is false
(the default) and the address string contains address group syntax.import { addressParser } from 'postal-mime';
const addressStr = '=?utf-8?B?44Ko44Od44K544Kr44O844OJ?= <support@example.com>';
console.log(addressParser(addressStr));
// [ { name: 'エポスカード', address: 'support@example.com' } ]
Decode MIME encoded-words.
decodeWords(encodedStr) -> String
Where:
The result is a Unicode string.
import { decodeWords } from 'postal-mime';
const encodedStr = 'Hello, =?utf-8?B?44Ko44Od44K544Kr44O844OJ?=';
console.log(decodeWords(encodedStr));
// Hello, エポスカード
© 2021-2024 Andris Reinman
postal-mime
is licensed under the MIT No Attribution license
FAQs
Email parser for browser environments
We found that postal-mime demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.