I’m not a spice merchant, and most exploits rarely involve a single step. This screenshot is just a system design red flag.

You’re free to examine the repo yourself and find your own spice, my 5 min look tells me that piefed needs to expend a significant amount of effort on infosec to maintain user trust in the longer term.