jira-issues

This is a Jira bulk-deletion utility, not apparent malware. It reads Jira credentials from environment variables or a nearby .env file and sends them to the configured JIRA_BASE_URL; with --confirm it deletes up to 500 returned project issues and their subtasks. The main risk is destructive operation and credential disclosure if the configured Jira URL is incorrect or untrusted; severity is high for data loss when deletion is confirmed.

This script is an explicitly destructive Jira administration utility: it deletes all issues returned for the configured project and their subtasks, without a confirmation step. It does not show evidence of hidden malware, but it can cause severe data loss; additionally, an attacker-controlled JIRA_BASE_URL could receive the configured Jira email and API token. Severity is high if executed with production credentials.