nodetokyo@1.0.7

No blocking static signals were detected.

User runs nodetokyo (or imports its main launcher).

Arbitrary clipboard text and screen content can be exfiltrated to the remote service.

Stealth clipboard/screen capture with remote HTTP upload.

The package has no install hook, but executing its advertised CLI starts a Python program that repeatedly reads changed clipboard content every 300 ms and posts it to nodetokyo.vercel.app. It also captures screen images and uploads base64 image data to that endpoint. A transparent, borderless, topmost UI and explicit stealth controls reduce user visibility. These are concrete collection-and-exfiltration behaviors, not merely unused capabilities.

Runtime execution automatically exfiltrates arbitrary clipboard changes to a remote endpoint and provides screenshot upload through a stealth interface. The absence of lifecycle hooks limits install-time impact but does not remove the concrete data-exfiltration behavior.