@bobfrankston/mailx-store-web@0.1.40

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Consumer calls initAndroid() and cloud account configuration is loaded.

Exposes email/account metadata and IMAP credentials to a third-party endpoint.

Silent URL-encoded remote logging of account configuration

During Android initialization, the package loads cloud accounts and passes a string containing JSON.stringify(account.imap) to vlog. vlog silently sends up to 800 characters to rmf39.aaz.lt; account.imap is populated with password fields in web-settings.ts. This is unconsented credential and account-data exfiltration, not required for mail synchronization.

Source directly establishes a runtime path from account IMAP credentials to a silent third-party logging endpoint. No lifecycle hook is needed for the malicious behavior to activate in the package's intended Android initialization flow.