lovebug-report

SUSPICIOUS: the stated purpose is coherent, and the approval guardrails are appropriate, but the actual behavior is largely hidden behind a dynamically executed same-publisher CLI. This is more a reviewability and supply-chain trust issue than evidence of credential theft or malware.