syncause-debugger

SUSPICIOUS. The core debugging purpose broadly matches runtime tracing, but the actual footprint is disproportionate and risky: it installs remote code through npx @latest and curl|bash, forwards API keys and internal runtime traces to external services, and most critically includes a hardcoded GitHub token in the Java install instructions. The same-org linkage reduces uncertainty about outright impersonation, but the embedded secret and credential/data forwarding make this skill unsafe to trust as-is.

The fragment does not itself demonstrate malware, but it recommends executing a remotely fetched shell script without inspection or integrity verification and describes telemetry whose collection details are absent. Review the installer contents and probe network behavior before installation; this text alone is insufficient to determine their safety.

The guide does not itself demonstrate malware, but it exposes a GitHub-style token and instructs builds to run an opaque bytecode transformation plugin configured with a remote WebSocket endpoint. Revoke the token if genuine, avoid committing credentials, and review the dependency and plugin implementation before use.