The godsplan 3.0.2 npm package CLI connects to a local Chrome debugging port and injects JavaScript into every open browser page, bypassing Content Security Policy. It collects page text and editor input, sending this data to an external third-party service without user disclosure or opt-out. The package disables TLS certificate verification for all HTTPS traffic in the Node process, increasing risk. This behavior occurs only when the CLI is executed, not at install or import time.