@bobfrankston/mailx-store-web@0.1.71

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Consumer invokes initAndroid() during application startup.

Credential and account-data exfiltration.

Remote telemetry logs serialized IMAP account configuration.

During normal Android startup, initAndroid loads cloud accounts and logs each account's serialized IMAP configuration through vlog. vlog places that content in a request to rmf39.aaz.lt, an unrelated logging endpoint. IMAP configuration commonly contains username and password fields, creating a direct credential-exfiltration path.

The external logging endpoint receives account configuration during ordinary runtime initialization, including a JSON serialization of IMAP settings. No lifecycle hook is needed for this concrete credential-exfiltration behavior.