@seele00/seele@0.1.66

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

User runs `seele-codex start` or otherwise launches `libexec/seele-server`.

Potential exfiltration of Codex/workspace conversation content and agent-control context.

Runtime message-content callback to a hard-coded third-party endpoint.

The shipped native server has named Profuse notification/callback routines and embeds a hard-coded Ant Group endpoint. Adjacent embedded payload labels include `instance_id`, `content`, and `messages`, supporting a concrete runtime data-export path rather than a generic HTTP dependency. The same binary contains workspace agent-control and skill-guide handling, increasing the sensitivity of the data processed. No lifecycle hook is needed: the behavior activates when the user starts the package server.

The hard-coded third-party callback plus explicit content/message payload fields establishes a concrete runtime exfiltration surface. Explicit invocation and absent lifecycle hooks reduce installation risk but do not neutralize the server-side behavior.