Runtime Android initialization serializes IMAP account configuration, then sends it to an unrelated remote log endpoint. IMAP configuration can contain passwords used by this package.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Host application calls initAndroid and loads accounts from Google Drive.
Impact
Exfiltration of email, IMAP host/user, and potentially IMAP password.
Mechanism
Silent remote logging of serialized account configuration
Attack narrative
When initAndroid runs, it loads cloud account records and calls vlog with JSON.stringify(account.imap). vlog URL-encodes and fetches that text to rmf39.aaz.lt silently. The same package uses account.imap.password for IMAP and SMTP authentication, making the logged configuration credential-bearing.
Rationale
Concrete runtime credential/configuration exfiltration to an unrelated endpoint is present in shipped JavaScript. No install hook is required for this malicious behavior.
Evidence
android-bootstrap.jssync-manager.jspackage.json