prior-work-retrieval

No obvious built-in malware/backdoor logic (e.g., no network exfiltration, no persistence, no credential harvesting) is present in this fragment. However, the package intentionally executes external code in two ways: it dynamically imports and executes a local prior_work_hook.py module (exec_module), and it runs arbitrary command adapters defined by the manifest (subprocess.run with manifest-provided argv). If either the shipped prior_work_hook.py or the manifest content is attacker-controlled (common in supply-chain or dependency confusion scenarios), this code can execute arbitrary commands with the caller’s privileges. Additional environmental risk exists if PATH is manipulated so that ‘rg’ or ‘git’ resolves to a malicious binary.