Email 163 Com Backup

• Analyzed: May 15, 2026, 7:23 AM
• Findings: 1
• Version: 1.0.0
• Hash: c063665e1e8ef966550f3f8e665048c44f430efe2e3c8089e0d1a6f1878078d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The bundle provides a 163.com email management tool but is classified as suspicious due to the inclusion of specific, functional-looking credentials (email and authorization code 'KZtfcUWCKGNFf9M9') within documentation files like SKILL.md, INSTALL.md, and TEST-REPORT.md. Furthermore, the install.sh script utilizes a risky 'curl | bash' pattern to fetch a remote payload from a placeholder URL. While the main.py script correctly implements the IMAP ID extension (RFC 2971) and lacks obvious exfiltration logic, the presence of hardcoded secrets and the remote-execution installer pose significant security risks.