mt-tech@1.0.11

One or more suspicious static signals were detected.

Running mt-tech loads bin/run.js.

Authentication material and request data can be exposed to hidden interception, while the daemon adds persistence and remote-update risk.

Process-wide network interception, device fingerprinting, and background self-updating.

The public CLI entry point silently loads @sec/cliguard before command handling. Direct inspection shows that dependency replaces HTTP, HTTPS, and fetch behavior, collects request bodies for signing, creates a device fingerprint, and starts a daemon capable of self-update checks. The package source is heavily obfuscated and its own README does not disclose this dependency or background behavior. This creates a concrete hidden collection and persistence surface whenever the CLI is used with tokens or signing keys.

The hidden runtime import activates an obfuscated network interceptor and fingerprinting self-update daemon, beyond the documented API-client behavior. The absence of an install hook does not remove the concrete runtime collection and persistence risk.