howells-lint

This appears to be a repository migration utility, not malware. It has command-injection exposure because untrusted repository paths are interpolated into shell commands, and it performs intentional destructive configuration edits. Pass trusted paths only and use spawn/execFile with argument arrays or robust shell escaping.