feishu-doc-fetch

No direct malicious behavior (exfiltration, backdoor logic, reverse shell, credential harvesting) is evident in this wrapper alone. However, it executes a bundled daemon (bridge/daemon.mjs) with detached/no-stdio visibility and then performs powerful filesystem writes/extraction using daemon-controlled msg.dataUrl and msg.filename. The wrapper only partially sanitizes filenames (folder name only) and relies on unzipInto()/writeDataUrl() to prevent unsafe writes (e.g., Zip Slip/path traversal). This yields a moderate overall security risk pending review of the daemon and extraction/writing helpers.