I am not aware of media/client link tampering, but I am most certainly not as plugged in or knowledgeable as you, semi. Can you elaborate at all? Has this been addressed?
Discussion
I've definitely seen nostr.build links get replaced with primal-hosted versions