Threats affecting pkg:npm/postal-mime

postal-mime versions before 4.2.1 have a parser vulnerability in the address parser that truncates the domain at folding whitespace or comments before a dot. This allows remote attackers to craft From headers that can pass SPF, DKIM, and DMARC alignment checks for their own subdomain while the parser reports a spoofed victim sender address.