@yun520-1/heartflow@5.7.3

No blocking static signals were detected.

A caller registers the fallback, then low-confidence reasoning invokes it.

Potential exposure of a foreign AI-agent API credential if the dormant path is activated and corrected/usable.

Hard-coded credential-file read followed by attempted Bearer-authenticated curl.

Hard-coded access to a foreign agent credential path plus attempted network use is not package-aligned, despite lacking an automatic trigger. The inactive registration requirement and malformed request make this suspicious rather than confirmed malware.