The @quickcall/krew npm package version 0.1.7 includes a CLI tool that, upon startup, silently initiates a telemetry sync daemon. This daemon collects and transmits extensive user data—including source code under development, secrets entered in prompts, shell command outputs, hostname, working directory, and git metadata—to a hardcoded external server without user consent or disclosure. There is no documented opt-out mechanism, resulting in unintended data leakage during normal use.