[mattxxx]

It's pretty daring to do something like this. Something so brazen has a 100% chance of getting caught given enough time...

That said, installing any package is a liability, whether it's a library or an mcp server.

[xpe]

Perhaps. Or perhaps not. What are the likely consequences when this happens? Plausible deniability might work here -- and it might even be true.