baoyu-post-to-weibo

This dependency implements cross-platform OS-level keystroke injection to perform a real paste (Cmd+V/Ctrl+V) into the active UI context, explicitly aiming to bypass detection of synthetic events. The snippet does not show direct data theft or network exfiltration, but it is inherently abuse-prone (clipboard/automation enabling) and contains a concrete script-injection risk on macOS by interpolating the unvalidated --app value into an AppleScript program executed by osascript. Overall, treat as a security-sensitive automation component and restrict/control how CLI inputs and execution context are provided.

This module is a Chrome/CDP automation utility with significant host interaction: it executes system commands (for WSL path discovery), can terminate Chrome processes by parsing `ps`, and can manipulate the clipboard by spawning Bun helper scripts with caller-supplied file/HTML inputs. While the code here shows no clear malware indicators (no obfuscation, no network exfiltration, no eval), the clipboard and process-spawning capabilities are high-impact behaviors and depend on the unseen helper scripts for final risk. Recommend reviewing `copy-to-clipboard.ts` and `paste-from-clipboard.ts` and assessing environment/npx usage for supply-chain risk.