yandex-performance-ops

This module is primarily an operational data-collection CLI and does not contain overt malware primitives itself. However, it performs a high-risk dynamic import of a JavaScript client module from environment-controlled and user-local filesystem paths without integrity verification. Since it passes a sensitive token (YANDEX_WORDSTAT_TOKEN) into that dynamically loaded code, a tampered/malicious client.js would have strong capability for credential theft or data exfiltration and can write arbitrary output files to the chosen outDir. Review/lock down the client path and verify module integrity in the broader supply chain.

No direct evidence of malware, obfuscation, or network exfiltration exists in this wrapper alone. The primary security concern is supply-chain/impersonation risk: it dynamically resolves and executes helper scripts based on environment overrides and a directory walk from PWD (including local .claude/skills paths) without integrity checks. If those locations or overrides are attacker-influenced, the wrapper can run trojaned helper code with a sensitive token exported from the user’s config, and write logs/artifacts into attacker-influenced directories.