web-traffic

SUSPICIOUS. The capability mostly matches the stated traffic-estimation purpose, but trust is weakened by a hostname mismatch with official Hedwig docs, a transitive plugin install from an unverifiable third-party namespace, and unclear provenance for the `traffic` program and related commands. Data flow is directionally consistent with the purpose, so this is not confirmed malware, but it carries meaningful supply-chain and trust-boundary risk.