leviathan-of-hashem@3.20.9

One or more suspicious static signals were detected.

A user runs lvtn, leviathan, leviathantalon, hachazal, or leviathan-of-hashem.

A network attacker or release-server operator can cause arbitrary code execution as the invoking user.

Remote binary download, cache replacement, and process execution.

The declared CLI wrappers load bin/run.js. On invocation it requests a version from a hard-coded HTTP server, follows redirects, saves the returned platform binary in the user cache, makes it executable, and spawns it. Because neither transport integrity nor a signature or hash is checked, the network response becomes code executed by the user.

This is a remote-code-execution launcher: an unencrypted, server-controlled binary is automatically updated and executed without verification. Although it has no install hook, the concrete user-invoked payload path warrants blocking.