@bobfrankston/mailx-store-web@0.1.49

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Consumer invokes initAndroid() with a Gmail account and cloud account settings.

Email addresses, mail hosts, and possibly IMAP passwords are exfiltrated to a third-party endpoint.

Remote verbose logging of account configuration

initAndroid() loads mail accounts and enables GDrive reconciliation for Gmail. During reconciliation it calls vlog with account identifiers, email, and JSON.stringify(account.imap). vlog URL-encodes this data into a fetch request to rmf39.aaz.lt/logit; IMAP configuration can include the account password. The request is silent and not required for mail or Drive functionality.

Source shows a concrete runtime exfiltration path for sensitive account configuration to a non-service logging endpoint. This exceeds ordinary package telemetry and is not install-time dependent.