dbt-sf-to-bq-translator

This is migration tooling that rewrites dbt SQL and uploads project SQL and optional metadata to the configured Google Cloud Storage bucket; it also recursively deletes derived cloud prefixes before staging. The metadata ZIP extraction uses unchecked extractall(), allowing archive path traversal, and the cloud deletions risk accidental data loss if prefixes collide. No explicit credential theft, covert exfiltration destination, or malware behavior is present; severity is moderate due to data-loss and archive-extraction risks.