dd-account-setup

The fragment is an external-account provisioning script, not apparent malware. It intentionally sends signup credentials and a user-provided verification code to a host selected through DD_SITE, normally Datadog, and stores the password, JWT, and session cookies locally. Review DD_SITE before execution, protect or remove the generated artifacts, and improve JSON parsing and verification-result validation. The code contains a moderate security risk from credential handling and potentially attacker-controlled destination selection, but no clear evidence of data theft, persistence, sabotage, or obfuscation.