@pisell/pisellos@0.0.571

High-risk behavior combination matched malicious policy.

Consumer initializes ScanOrder or VenueBooking.

Application/order data and error contents can be disclosed to package-selected receivers.

default-enabled POST of application logs to embedded webhooks

On runtime initialization, ScanOrder and VenueBooking select the Feishu logger and supply embedded usable webhook URLs unless the consumer overrides configuration. The logger builds records from operation payloads, context, and serialized errors, then POSTs them to those receivers. Numerous operational methods log user-provided parameters and error data, creating a concrete unconsented application-data exfiltration channel.

The source confirms default-enabled transmission of rich runtime records to hardcoded external receivers, not merely a generic network capability. This is concrete data exfiltration despite the absence of install-time execution.