baoyu-post-to-wechat

This module primarily performs WeChat posting automation, but it contains a high-risk supply-chain/security abuse behavior: it captures the WeChat login QR code from the browser and sends it to Telegram using bot credentials from environment variables. That is direct exfiltration of authentication-enabling material. Additionally, it heavily relies on CDP Runtime.evaluate with dynamically constructed expressions and executes local helper binaries via spawnSync, increasing overall risk. No direct system compromise primitives (e.g., reverse shell, file erasure) are evident in this fragment, but the QR-to-Telegram capability makes the package potentially malicious/abusive depending on its usage context.

This fragment is consistent with a legitimate publishing automation CLI but has meaningful security boundaries: it executes an external renderer via spawnSync('npx' + 'bun') and then trusts its JSON output without schema validation, and it uploads local content/images (including a user-controlled cover path) to WeChat APIs—so misuse or attacker-controlled inputs can lead to local file disclosure/upload and unintended publishing. No strong indicators of hidden malware/backdoor behavior are evident in the provided code, but the supply-chain/environment sensitivity of npx/bun and the unvalidated trust in renderer output merit review of the helper and the upload/publish implementations.