howells-lint

This appears to be a repository migration utility, not malware. It has a command-injection risk because an externally supplied repository path is interpolated into shell commands, most clearly in the unquoted rg invocation. It also intentionally removes or replaces configuration files. Use a trusted repository path; prefer spawn/execFile with argument arrays and avoid shell interpretation.