input-validation-checker

SUSPICIOUS: the stated purpose is a benign input-validation helper, but the broad Bash(npm:*) permission is disproportionate to the vague instructional scope and creates medium supply-chain risk. No concrete credential theft or exfiltration behavior is present, so this is not confirmed malware.