migrate-webflow

This is a Webflow CMS export utility with no clear evidence of malware. Its principal security risk is that `--apiBase` can point to an arbitrary host while the script sends the environment-sourced Webflow bearer token there; restrict this option to trusted endpoints. Rich-text HTML is sanitized for the `html` field, but the original content is also retained in `raw`, which downstream consumers should treat as untrusted. Severity is moderate and depends on who controls the CLI arguments.