postal-mime

Email parser for Node.js and browser environments

Latest 4.0.5

88%

Total Score

healthy

Active maintenance, strong release transparency, and organization backing outweigh workflow pinning and install-script concerns.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepare script runs during installation or package preparation, adding execution during dependency setup. No provided signal shows that it is unsafe, so this is a limited supply-chain hygiene concern rather than a severe risk.

Security policy

No repository security policy was found. That is a transparency gap for reporting vulnerabilities, although active maintenance and security scanning provide partial compensation.

Workflow audit

Both workflows were analyzed successfully with no untrusted checkouts or script injection, but all 5 action references are unpinned and one workflow has top-level write permissions. The only audit finding is low-confidence cache-poisoning, which is hygiene rather than a standalone severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-297362 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. postal-mime is vulnerable to Denial of Service (DoS) in versions 1.0.8 - 2.7.5.	1.0.8 - 2.7.5	Medium
AIKIDO-2026-10419 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. postal-mime is vulnerable to Improper Input Validation in versions 1.0.1 - 2.7.3.	1.0.1 - 2.7.3	Medium
AIKIDO-2025-10871 postal-mime is vulnerable to Denial of Service (DoS) in versions 1.0.0 - 2.6.0.	1.0.0 - 2.6.0	Low