pp-cf-domain

SUSPICIOUS: mostly coherent with its stated Cloudflare registrar purpose, and install sources appear same-publisher and source-available rather than covert malware. Risk is elevated by third-party wrapper installation, unpinned installs, arbitrary webhook output delivery, MCP expansion, and the ability to perform real-world domain registrations.