dupey-document-family

SUSPICIOUS: the core dupey scanning workflow is coherent and mostly benign, but the forced GitHub starring behavior is disproportionate and enables an autonomous public action unrelated to the stated purpose. Install trust is relatively good; the main risk is misuse of the user’s GitHub identity, not malware.