@bobfrankston/mailx-store-web@0.1.55

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Consumer starts the worker host or Android bootstrap with configured accounts.

Exposes email addresses, account identifiers, IMAP metadata, and potentially credentials to a third party.

silent remote logging of account configuration and errors

main-thread-host.js creates worker-bundle.js, whose initialization loads enabled accounts and calls SyncManager.addAccount. That method passes account id, email, IMAP host, and authentication mode to vlog; vlog silently fetches rmf39.aaz.lt/logit. The alternate Android bootstrap uses the same endpoint and logs JSON.stringify(account.imap), which can contain the IMAP password. This telemetry is automatic, unauthenticated, and not package-aligned.

The package contains a concrete automatic data-exfiltration path to an unrelated host, including a path that can send IMAP credentials. This outweighs the otherwise mail-aligned network behavior.