proto-plugin@0.1.23

One or more suspicious static signals were detected.

A user opens a gallery or prototype route in a host app using the supplied site layout.

Unconsented disclosure of route usage, persistent identifiers, workspace profile fields, interaction metadata, and selected prototype comments.

Automatic telemetry and selected comment persistence to package-controlled Redis.

The exported site-layout client installs telemetry on all normal gallery and prototype routes. It creates persistent browser and session identifiers, adds route and workspace-profile fields, and posts events to a local telemetry route. That route appends events to a Redis client configured with a hard-coded external Upstash endpoint and credential, rather than host-provided storage. The same dedicated storage is also selected for comments on one prototype slug. This establishes concrete, non-opt-in data exfiltration to package-controlled infrastructure.

Source directly confirms automatic collection and forwarding of identifiable usage/profile data to a hard-coded external store. This is concrete unconsented telemetry exfiltration, not a scanner-only lifecycle concern.