Ran it with Little Snitch installed (why bother looking at the code when a malicious actor can just upload a modified binary anyway?) and the claims seem to be legit so far.