pp-wanderlust-goat

Purpose and core capabilities mostly align with a travel recommendation CLI, and it does not request credentials or obvious secret files. Main concerns are unpinned third-party installation, unclear publisher-to-package provenance, optional arbitrary webhook posting, and transitive MCP installation. Overall this is suspicious rather than clearly malicious.