convex-check-updates

SUSPICIOUS. The stated purpose is coherent, but the install/execution path is disproportionally risky: it executes mutable remote code from a platform-hosted convex.site deployment with unclear official provenance. This is primarily a supply-chain trust problem rather than confirmed malware.