catalyst-datastreams

This is Data Streams integration documentation, not evident malware. The token-endpoint example trusts request-supplied userId and returns the resulting token without showing authentication or authorization, which can enable user impersonation if used as written; authenticate the caller and bind the requested ID to that identity before issuing a token. No suspicious domain, hardcoded credential, or obfuscated payload is present. Security risk is moderate due to the authorization flaw in the example.