fal-upscale

SUSPICIOUS: the catalog entry's stated purpose is coherent, but it is not self-contained and redirects users to install an upstream bundle plus a remote-script-installed CLI. Same-org evidence makes this look more like elevated supply-chain and transitive-trust risk than malware, but the indirection and installer pattern are enough to classify it as suspicious rather than benign.