The pack has an injected file 'Editor/BlendShapeUtility_kip.cs' (class ABF_ControlPanelTrigger_Prod_Kip) that:

• auto-runs via [InitializeOnLoad] the moment the Unity project opens;
• silently reads your VRChat display name via reflection (VRC.Core.APIUser.CurrentUser.displayName);
• posts it to an AES-encrypted Discord webhook ('きぷでか2', guild 1388867720816234686) using WebClient.UploadData;
• writes a stop-flag to Library/UnityCache/config_kip and swallows all errors.

The original Booth pack (booth.pm/items/7211713) does NOT contain this file. zenpit did the same thing to 'Avatar Blink Fix' (BlendShapeUtility.cs / ABF_ControlPanelTrigger_abf11, webhook 'Captain Hook', same Discord guild) — admin already flagged that topic and it was deleted, and zenpit's posts here (#3, #4) were also deleted.

If you downloaded this from zenpit:

1. delete 'BlendShapeUtility_kip.cs' (and any 'BlendShapeUtility*.cs') from your project;
2. review the whole pack for other injected files;
3. your VRChat display name may have been sent to that server, so be careful.

Please flag zenpit's posts and don't trust his repacks. Stay safe!