neon-theme

SUSPICIOUS. The data flow stays within official build.host infrastructure and the installer appears same-publisher, so this is not strong malware evidence. However, a theme/design skill has a broader footprint than styling alone: local credential access, browser-session auth use, and optional deployment, plus an unpinned curl|bash installer. Risk is moderate and mainly comes from install trust and credential/deploy scope rather than confirmed malicious behavior.