mailparser 3.13.0

v3.13.0

on Node.js NPM

3.13.0 (2026-10-29)

Summary

mailparser now reads the OTP-Token header (draft-goto-otp-token), the header Nodemailer 10.3.0 sets with its otp option, and exposes the one-time passcode as otp: { code, origin } on the simpleParser result and on the MailParser instance. Parsing follows the same rules as PostalMime.

Who should upgrade

No hurry. Upgrade if you want to read one-time passcodes from incoming mail.

Highlights

• New otp property, set only when the message header has exactly one valid OTP-Token header with a canonical https origin (or an http origin on a loopback host). Headers in MIME parts or forwarded messages are ignored.
• The header is not authenticated: check that the message has a valid DKIM signature from the domain of the origin before offering the code.
• otp is experimental and may change in a minor release when the draft does.
• Dependency update: nodemailer 10.3.0.

Features

• parse the OTP-Token header into mail.otp (bc20682)

Bug Fixes

• update dependencies (f94b954)