md-to-word

No clear evidence of stealthy malware (tracking/backdoor/exfiltration) is present in this snippet. However, the module is operationally risky: it uses execSync to invoke shell commands (npx mmdc, npx svgexport, and pandoc) with interpolated arguments derived from user-controlled inputs/paths, and it enables arbitrary Pandoc Lua execution via a user-supplied --lua-filter. In a threat model where an attacker can influence inputs or file paths, this can become command injection / arbitrary code execution during conversion.