cavalry

This fragment does not contain actual malicious implementation, but it exposes a very dangerous host API surface: dynamic script execution (load/exec), arbitrary OS process execution (runProcess/runDetachedProcess), clipboard access, extensive filesystem read/write/delete, and embedded web client/server with authentication/proxy support. In a supply-chain context, any dependency that can invoke these primitives (or auto-run untrusted scripts) could enable malware behavior (exfiltration, data theft, command execution). Without the package’s implementation, specific malicious intent cannot be proven from this fragment alone.

This module provides a localhost execution bridge with two high-risk capabilities: (1) arbitrary JavaScript execution via api.exec using request-supplied content, and (2) local script execution via ui.runFileScript using request-supplied filesystem paths. Header-based cross-origin rejection is not sufficient to prevent malicious requests. While binding to 127.0.0.1 limits off-host attackers, any process on the same machine can potentially trigger code execution, making the overall security risk very high unless the caller is fully trusted and isolated by environment controls.