A 1,145-Star CLI Promised "Nothing Leaves Your Machine". It Executes a Hidden Payload at Import Time.

A 1,145-star dev tool that claimed to run entirely locally fetched and executed code at import time. The five static checks that now gate every repo I install for my coding agents - and where they still fail.