tree-view

The code is a directory-tree display utility, but its unquoted interpolation of DEPTH into execSync creates a command-injection vulnerability when DEPTH is attacker-controlled. Temporary-file creation also has a local race/symlink concern. No clear evidence of intentional malware or data exfiltration is present.