asyncreview@0.4.0

Analysis

asyncreview@0.4.0 is published as a 480 MB npm tarball containing 29,902 files, far beyond its declared purpose as a command-line GitHub PR/issue review tool whose only declared dependencies are ora, chalk, inquirer and commander and whose entry point is dist/index.js. The tarball embeds two complete Python virtual environments — python/.venv and python/.venv_test — including third-party Python packages such as litellm and pip's vendored Windows launcher binaries (pip/_vendor/distlib/t32.exe). This bundled interpreter environment is shipped to every installer of the package and is unrelated to the package's declared functionality. No network indicator of compromise is present in the published metadata.