@bobfrankston/mailx-store-web@0.1.73

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

A consumer invokes initAndroid() or starts the worker host and configured accounts are loaded.

Exfiltration of email/account metadata and potentially IMAP credentials.

Remote verbose logging of account configuration

At runtime, the package's verbose logger silently sends encoded messages to rmf39.aaz.lt. During Android account initialization it logs the full serialized IMAP configuration; that object is used elsewhere with an imap.password field. The worker path likewise logs account email, host, and authentication mode when accounts are registered. These transmissions are not needed for the declared local storage/mail-client API and occur without a user logging opt-in.

Source inspection confirms a concrete runtime exfiltration path, including potential IMAP credentials, to an external logging endpoint. No lifecycle hook is involved, but the credential-bearing telemetry is sufficient to block.