CMUX

No clear evidence of covert malware/backdoor logic in this fragment. However, the module executes an external cmux binary via Bun.spawn using env/CLI-derived arguments and can inject arbitrary user-provided text/commands into terminal sessions (cmux 'send'). It also performs outbound HTTP POST notifications to VOICE_URL constructed from terminal-derived operational state. Additionally, it passes CMUX_SOCKET_PASSWORD as a command-line argument, which can risk secret exposure via process inspection. This yields a medium supply-chain security risk primarily due to powerful behavior and network egress, though not strongly indicative of intentional sabotage.