huawei-cloud-publish-work-to-gallery

This resolver locates or installs gitcode-oauth and executes candidates with --help. Installation downloads the latest binary from api.gitcode.com and gitcode.com without checksum or signature verification, then stores it in the user bindir; release tag metadata is interpolated into a shell command. No credential harvesting or unrelated data exfiltration is evident; severity is a moderate supply-chain risk because a compromised release or metadata source could lead to execution of an untrusted binary.

This utility invokes hcloud to configure a region and retrieve an IAM domain. It has a significant command-injection risk because command-line arguments and environment-derived credentials are interpolated into execSync shell strings without escaping; credentials are also exposed as CLI arguments and may be stored by hcloud. No direct malicious network destination or other clear malware behavior is present; severity is a security warning, especially when inputs or environment variables are untrusted.

This script configures a user-level binary directory and persistently adds it to PATH. On Windows, an attacker-controlled PATH entry can escape the single-quoted PowerShell command in expandVar() and execute arbitrary commands as the current user when PATH is processed; this is a high-severity command-injection risk, though the fragment alone does not establish malicious intent. It also creates and prioritizes a writable `.huawei/bin` or `~/.local/bin` directory, which can enable execution of binaries placed there. No network endpoints or hardcoded credentials are present.