It's not really malware, but it's a mess. It installed so much shit and it interfered with your git hooks and stuff. It was kind of messy. I kind of gave up on it. I just went back to using built-in claude code todowrite tasks.

It managed to throw itself into a global file for me that Claude used which caused beads to appear in random projects on my machine. Because of how it was there the agent attempted to re-install beads after I already removed it because the guy hook errored.

Haven't tried it, but this rewrite might be better?

https://github.com/Dicklesworthstone/beads_rust

Try https://github.com/hmans/beans - I find it a refreshingly pragmatic take that works great with my agents use.