Proof REA is is malicious.
This repository is simultaneously:
(1) the vehicle for an active social engineering campaign harvesting credentials and biometric data from users who install it,
(2) the subject of apparent artificial star inflation to manufacture legitimacy, and
(3) the host of an architectural vulnerability enabling prompt-injection-to-RCE in AI agent workflows.
The combination of pre-positioned @latest install instructions and a coordinated amplification network represents a complete supply-chain attack delivery mechanism should a malicious package version be published.