I expect this sort of thing when installing/running the client, but I can see why it would be alarming for a CLI installed via NPM to do this