savethetokens

The package will execute a local installer (node bin/install.js) after installation and an uninstall script on removal. This is a potentially high-risk pattern because those scripts run with user privileges and can perform arbitrary and persistent actions (data exfiltration, telemetry, installing hooks, modifying files, etc.). You should inspect the contents of bin/install.js and bin/uninstall.js (and any files they call) before installing, run them in a sandbox, or avoid installing unless you trust the author.