callsmith

This installer script itself contains no obvious in-snippet malware (no credential harvesting, exfiltration, reverse shell, or obfuscated logic). However, it performs high-impact supply-chain operations: it downloads and extracts executable Node.js code from a moving GitHub branch and/or performs a GitHub-sourced global npm install, then executes the installed entrypoint via a user-accessible wrapper. The primary risk is lack of integrity pinning/verification (no checksums/signatures/pinned commit), making the trust boundary entirely dependent on upstream and transport. Recommend pinning to a specific release/commit, verifying cryptographic checksums/signatures, and minimizing/controlling npm lifecycle execution (e.g., lockfile/pinned version and safer install options).