threejs

SUSPICIOUS. The catalogue entry is lightweight and does not itself steal data or execute code, but it mainly redirects trust to an external upstream bundle, and the reported mismatch between CloudAI-X and pinkforest install guidance weakens provenance. Low direct malware evidence, moderate security risk from transitive installation and unclear upstream ownership consistency.