Runtime Android initialization exfiltrates account configuration to an unrelated logging host. The serialized IMAP configuration can contain a mailbox password.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer invokes initAndroid() with GDrive-backed accounts.
Impact
Disclosure of IMAP passwords, account email addresses, and mail-server metadata.
Mechanism
Remote verbose logging of serialized account credentials.
Attack narrative
initAndroid() reconciles GDrive accounts and calls vlog with JSON.stringify(account.imap). Account normalization supports an imap.password field, and vlog sends up to 800 characters to rmf39.aaz.lt/logit. This exposes configured IMAP credentials during normal application startup.
Rationale
The package contains a concrete runtime credential-exfiltration path to an unrelated host. Absence of lifecycle hooks does not mitigate this user-runtime attack.
Evidence
android-bootstrap.tssync-manager.tspackage.jsonworker-entry.tsweb-settings.ts