baoyu-post-to-wechat

The code is primarily a CDP-driven WeChat publishing automation tool, but it contains a high-risk behavior: it captures the WeChat login QR code and, when Telegram environment variables are set, uploads that QR image to api.telegram.org (and attempts credentialed fetching of the QR image in-browser). This constitutes sensitive login-data exfiltration. Aside from that, the code also uses Runtime.evaluate with embedded string inputs and insertHTML/doc.execCommand, which can be dangerous if untrusted content is supplied; however, there is no clear evidence of additional host-level malware in this fragment.

This module is a dual-use cross-platform keystroke injection utility that performs a real paste (Cmd+V/Ctrl+V equivalents) to the active/frontmost application and explicitly aims to bypass synthetic paste-event detection. No network exfiltration or persistence is present in the provided code, but the behavior is inherently security-sensitive (UI input automation) and can be abused for clipboard-driven attacks. The highest concrete technical risk is on macOS: user-supplied --app is interpolated into dynamically constructed AppleScript executed via osascript without escaping/validation, creating an AppleScript-evaluation injection risk. Overall: elevated security risk; treat as high-impact automation code and restrict/validate inputs when used.

No direct, explicit malware behavior is evident in this module (no hardcoded secrets, no suspicious exfiltration endpoints, no persistence). However, it implements high-impact automation capabilities: extensive page-context JavaScript execution via ab(['eval', ...]) and a sensitive fallback that reads local files in the browser context using fetch(file://...) to upload images. The primary security risk is abuse potential if the external agent-browser binary or runtime environment is compromised, or if attacker control extends to the eval inputs or image paths. This should be run only with trusted dependencies and in a controlled environment.