fittings-semver-bump-classify

The stated purpose is coherent, but the execution model is not proportionate to a simple SemVer classifier: it may require fetching and running an unpinned remote script, then supplying a wallet private key to that script for off-chain payment signing. The service endpoints match the described product, so this is better classified as suspicious/high-risk supply-chain and credential-forwarding exposure rather than confirmed malware.