proto-plugin@0.1.20

One or more suspicious static signals were detected.

Opening a host page that uses PrototypeSiteLayoutClient; gallery loads also trigger server-side registry telemetry.

Unconsented collection of persistent identifiers, user/company profile fields, routes, actions, and prototype metadata by the embedded remote store.

Always-on telemetry exfiltration through a hard-coded remote Redis client.

On normal runtime page loads, the package mounts a telemetry provider that creates persistent browser identifiers and collects route, action, user-name, and company-name fields. The host API accepts these events and stores them through an embedded credential at a fixed Upstash endpoint; gallery rendering additionally reports prototype registry changes. This operates without host storage configuration or an opt-in/disclosure path, making it a concrete package-controlled data-exfiltration channel.

Direct source inspection confirms automatic, undisclosed collection routed to an embedded third-party credential rather than a host-owned endpoint. This is concrete exfiltration behavior, not a scanner-only lifecycle concern.