
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
throwaway-email
Advanced tools
A blazing-fast email validator and disposable email detector, powered by automated disposable domain aggregation.
A high-performance email validation library featuring real-time disposable email detection. Our database is continuously updated through automated aggregation of disposable domains from trusted community sources.
Currently 183,510
known disposable domains detected, this updates every week.
This project automatically maintains its disposable email domain list through workflows and scraping, but relies on open-source contributions to keep scrapers and filters up-to-date—learn how to help.
While this is primarily a Node.js package, you can also access the raw disposable domain list directly at: 📁 data/domains.txt
# make sure to use @latest since this package updates every week
npm install throwaway-email@latest
import validEmail from 'throwaway-email';
// Standard validation (TLD + Disposable check)
validEmail("johndoe@gmail.com") // true
validEmail("johndoe@gmail.con") // false (invalid TLD)
validEmail("johndoe@dispose.it") // false (disposable domain)
validEmail("john..doe@gmail.com") // false (invalid local part per RFC 5322)
// Disable ICANN TLD validation (still requires ≥2 character TLD)
validEmail("johndoe@gmail.con", false) // true
validEmail("johndoe@gmail.c", false) // false (TLD too short)
// Disable disposable domain check
validEmail("johndoe@dispose.it", true, false) // true
validEmail("john..doe@dispose.it", true, false) // false (invalid local part)
Parameter | Type | Default | Description |
---|---|---|---|
checkTld | boolean | true | Verify ICANN-approved TLDs |
checkDisposable | boolean | true | Check against disposable domains |
All benchmarks were measured over 10 million runs (averaged), executing each package according to its official documentation. Tests were conducted from an imported state to reflect real-world usage. All runs used the same inputs. You can verify these results by running the benchmarking script: benchmark/index.ts
.
Package | Avg. Time (per validation) | Validation Logic |
---|---|---|
throwaway | 155.73 ns | • Local part validation • Domain validation • RFC compliance checks • TLD validation • ICANN verification • 70,000+ domain blacklist check |
email-validator | 180.47 ns | • Regex pattern matching • Length verification |
@shelf/is-valid-email-address | 404.70 ns | • Local part regex • Domain regex • Quoted string check |
If you believe a legitimate domain has been mistakenly identified as disposable, you can help improve the validator by contributing to our allow list.
How to contribute:
allow_list.txt
We welcome community contributions to help maintain the accuracy of our validation system.
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
This project is released under the GPL-3.0 license, which grants you the freedom to:
With the critical requirement that you:
While the license permits commercial use, I strongly believe:
🔓 Data about disposable email domains should remain a public good—free to access, analyze, and redistribute. If you profit from this work:
doodad-labs/throwaway-email-checker
).This ensures transparency and helps protect the internet from abuse.
This project is automatically maintained through web scraping and data aggregation, but our sources may become outdated, and some domains might be incorrectly flagged. We need your help to improve accuracy and keep this resource reliable!
We intentionally keep this project beginner-friendly to help newcomers start their open-source journey. No experience needed—just a willingness to learn!
Help make this project accessible globally by translating documentation or UI elements.
allow_list.txt
)If you spot a legitimate domain mistakenly flagged as disposable, submit a correction.
Found an issue? Open a ticket or submit a fix!
Every contribution—big or small—helps keep the internet safer and more transparent!
FAQs
A blazing-fast email validator and disposable email detector, powered by automated disposable domain aggregation.
We found that throwaway-email demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.