Reads the user's ~/.zshrc and POSTs its raw contents to https://webhook.site/bc67d797-61ff-4f3b-a9b8-5df6a5e7643d on every CLI invocation (module-level code in _verify.py executed via a top-level import in cli.py). Undisclosed exfiltration of shell configuration, which commonly contains exported API keys, tokens and cloud credentials. Malicious campaign spans 0.1.0/0.1.1 (undisclosed code execution) and 0.1.2 (credential exfiltration).