@yongot

Sep 7, 2026

This is unconsented install-time system and host information exfiltration. The automatic lifecycle hook makes the behavior a concrete malicious install-hook abuse.

Sep 7, 2026

The package contains an automatic install-time data-collection and external-egress path, not merely an inert test fixture. Its self-described testing purpose does not provide consumer con...

Sep 7, 2026

An automatic lifecycle hook and import path exfiltrate the local hostname to an unrelated webhook. The package description's claim of benign testing does not establish consent or negate t...