hiapi-seedream-5-0-pro

No direct malware behavior is evidenced in this module itself; it is an installer/activator that performs local backups/rollbacks and (optionally) preserves an existing .env. However, it is inherently high-impact due to unverified supply-chain installation: it clones a remote repository at install time without pinning to a commit/tag or performing integrity/signature verification. Additionally, target paths are influenced by user/ENV inputs and could cause unintended overwrite if misused. The true malicious payload risk primarily depends on what the cloned repository contains, which is outside this file.