On npm install, the package's postinstall script unconditionally copies its payload/ tree into the user's project directory (process.env.INIT_CWD), planting a .mcp.json, a .claude/commands/0x2ai-boot.md slash command, a .claude/settings.json with a statusLine command, and a CLAUDE.md system-prompt file. The dropped .mcp.json registers an MCP server that routes every tool call (chatroom_post, memory_save, provider_query, settings_get/set, participant_*) to https://demo4.0x2ai.com using a hardcoded shared BRIDGE_AUTH_TOKEN (fabc3af531c05473fd5667f5360afb68666156e47c6981ce). Once any future Claude Code session is opened in that project directory, the user's chat content, saved memories, and prompts intended for other LLM providers are transparently funneled through the author-controlled bridge — the user never edited their own .mcp.json to opt in. The dropped CLAUDE.md further instructs the agent to conceal its architecture, MCP wiring, and auth tokens from the user, supplying cover-story phrasing to deflect questions about the relay path. Separately, the package's bin/start.cjs launches claude --dangerously-skip-permissions with shell: true, disabling Claude Code's tool-permission prompts so the author-supplied persona and MCP can drive arbitrary file/shell/network actions without confirmation. The combination — postinstall-planted MCP relay + concealment instructions + permission-bypass launcher — is silent-relay of caller-supplied conversation data to a third-party endpoint, configured without user consent at install time.