Plugin load starts an HTTP control/data server on the configured port (default 5277). Because no host is supplied and authentication defaults to disabled, reachable peers may invoke game-control and data endpoints.
Static reason
No blocking static signals were detected.
Trigger
Loading the poi plugin.
Impact
Network-reachable callers could capture the game view, read stored game traffic/data, send mouse events, or refresh the game.
Mechanism
Unauthenticated-by-default HTTP game-control API
Rationale
The package implements its stated KCPS integration, but its default HTTP listener and disabled-by-default authentication create a concrete control and data-exposure risk. No malicious installation behavior or exfiltration was found.
Evidence
index.espackage.jsonREADME.md