gfff5@1.0.0

No blocking static signals were detected.

User runs the gfff5 executable; clipboard monitoring begins at runtime.

Sensitive clipboard contents and screenshots can be disclosed remotely.

Clipboard and screen capture exfiltration to a hard-coded API

The package presents as a system configuration tool but its CLI runs a Python overlay. While visible by default, it polls the clipboard and sends changed text to a remote endpoint automatically. Its hotkey path captures the entire screen and uploads the encoded image to the same endpoint. Stealth-oriented hidden UI and hotkeys reduce user awareness of this behavior.

This is concrete runtime data exfiltration, not merely a capability library: clipboard transmission starts automatically when the CLI runs. The absence of an install hook limits install-time impact but does not negate the malicious user-data collection behavior.