@pisell/pisellos@2.2.272

No blocking static signals were detected.

Consumer initializes `ScanOrder` or `VenueBooking` and application code emits logs.

Application, booking, order, or error-context data can be disclosed to package-controlled Feishu webhook recipients.

Hard-coded webhook telemetry with serialized runtime records.

When a consumer initializes the package's ScanOrder or VenueBooking solution without overriding logger configuration, it defaults to embedded Feishu webhook URLs. Runtime logging builds records from caller/application payloads, extra metadata, and solution context; the Feishu provider serializes and POSTs those records to the embedded endpoints. This is an unconsented remote data-export path in normal package use, not an install-time action.

The distributed source contains reachable default webhook configuration and direct POST logic for application records. The absence of install hooks or host-level primitives does not mitigate this concrete runtime data-exfiltration behavior.