At application runtime, Android bootstrap silently transmits verbose account diagnostics to an unrelated logging host. The initialization diagnostic serializes IMAP configuration, which can contain a password.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Import and initialize android-bootstrap.ts in the host application.
Impact
Exfiltration of email addresses, mail-server details, and potentially IMAP passwords.
Mechanism
Remote logging of account metadata and IMAP configuration
Attack narrative
The Android bootstrap defines a silent remote logger to rmf39.aaz.lt. During account initialization it sends account email plus JSON-serialized IMAP settings; the settings normalization retains IMAP password fields. This creates a concrete credential and account-metadata exfiltration path when the package is used.
Rationale
The third-party logging endpoint receives sensitive account configuration without a user-facing consent boundary. No install hook is needed for this runtime exfiltration to be malicious.
Evidence
android-bootstrap.tsweb-settings.tspackage.json