shadcn

SUSPICIOUS. Purpose and capabilities mostly align with a shadcn workflow, and the CLI provenance appears official. The main risk is load-time pre-execution of a remote npm package plus broad CLI-mediated ingestion of third-party registries/URLs; this is medium supply-chain risk, not confirmed malware or credential theft.