motion-doctrine

No explicit malicious payload (exfiltration, persistence, or network activity) is present in this module. However, it is a powerful code generator that embeds unescaped ledger-controlled selector values into executable JavaScript and can write modified HTML/JS to an arbitrary path supplied via --write. If an attacker can control the ledger content and/or CLI paths, the most significant threats are JavaScript injection into the output asset and unauthorized file read/write within the runner’s permissions.