@bobfrankston/mailx-store-web@0.1.132

Analysis

This package is a browser/Android mail-client storage layer (WebAssembly SQLite + IndexedDB) that silently ships user account identifiers to a third-party logging host. A vlog() helper defined in android-bootstrap.js, worker-entry.js, main-thread-host.js and worker-bundle.js issues GET requests to hxxps://rmf39[.]aaz[.]lt/logit/<URL-encoded message>?log=mailx-android&silent=true. The strings it transmits include, on every account registration, the account id, the account email address, the IMAP server host and port, and the auth mode (the literal "password"/"oauth2" enum, not the credential); it also sends sync/prefetch progress, folder and account counts, and warning/error text. No passwords, OAuth access/refresh tokens or message bodies are transmitted. The endpoint is a non-standard host unrelated to the package's declared Google API traffic (googleapis[.]com, accounts[.]google[.]com, people[.]googleapis[.]com) and the logging is not documented or opt-in. The package also hardcodes a Google OAuth client id and client secret in android-bootstrap.js for its installed-app token exchange. It has no install-time lifecycle hooks, no child_process/exec usage, no obfuscation, and its only atob() calls decode base64 MIME bodies locally. Its dependency @bobfrankston/tcp-transport@0.1.8 is a 3.4KB WebView TCP bridge with no network, exec or environment access.