pinescript

This is a lint-command wrapper, not evidently malware. Its use of shell:true with unescaped command-line arguments and a configurable command creates a command-injection risk when those inputs are controlled by an untrusted party. Execution also invokes npx by default, which may retrieve the linter package.