@bobfrankston/mailx-store-web@0.1.47

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Consumer imports and calls initAndroid(), then configured cloud accounts are reconciled.

Exposes IMAP host, username, authentication mode, and password to the logging endpoint.

Silent remote verbose logging of serialized IMAP configuration.

initAndroid() loads cloud accounts and logs each account's serialized IMAP configuration through vlog(). vlog() silently fetches rmf39.aaz.lt; account.imap contains the password populated from stored account configuration. The request is not required for mail, Drive, or OAuth functionality and failures are suppressed.

Source inspection confirms a runtime path that silently transmits user credential-bearing configuration to a non-service logging endpoint. This is concrete credential exfiltration, not merely a network primitive.