new-project

This is intended to scaffold projects, generate files, and invoke framework tooling, with no visible credential exfiltration or direct malicious network traffic. However, the supplied source contains major syntactic discontinuities and an anomalous PHP/path-write fragment, so it should be treated as potentially tampered or incomplete and not executed until checked against the original repository. User-controlled values are also interpolated into generated files and paths with inconsistent escaping and validation. Severity: high review concern for source integrity; no confirmed malware behavior or destination domain is shown.