xiaohongshu-note-detail

SUSPICIOUS: the core browser scraping purpose aligns with the claimed function, and no explicit credential exfiltration or attacker endpoint is present. Risk comes from shell-eval execution, hidden helper scripts, transitive tool reliance, and explicit anti-scraping/stealth guidance that exceeds a simple read-only extraction workflow.