magister

The code appears intended as a Magister API client, with no clear evidence of deliberate malware. It has meaningful credential-exposure risks: redirects can receive authentication cookies, and caller-supplied hosts or API-provided links can receive bearer tokens. Restrict requests to the expected Magister origins and use cryptographically secure randomness for OIDC state and nonce.