minions

Within this module, there is no direct evidence of stealthy malware (no network exfiltration, credential theft, persistence, or destructive actions). However, the wrapper executes a JavaScript companion script discovered in a user-writable HOME cache directory, and therefore inherits any maliciousness present in that companion file (or tampering of that cache). It also trusts companion-provided JSON fields (including logFile paths) for control decisions, though it only reads metadata. Overall risk is driven primarily by local/code-execution trust-model weakness rather than by in-module malicious logic.