harvard-artifacts-collection-analytics-etl

SUSPICIOUS. The data flows and credentials are proportionate to an ETL/dashboard skill and route to official Harvard API or the user's own database, so there is no strong exfiltration signal. However, the main install source is an unrelated personal GitHub repository rather than the named publisher or an official packaged release, with unpinned dependencies and no integrity verification, making provenance and supply-chain trust weaker than expected.