jfrog-init

Benign in isolation as a PATH-resolution and synchronous execution helper, with no direct indicators of malware, exfiltration, or persistence. However, it is security-sensitive: it can mutate PATH order and it can execute host processes via spawnSync with limited internal safeguards. If upstream code supplies untrusted command/args or an untrusted directory to prependToPathIfMissing, it can enable PATH hijacking or command execution.

This module is a local credential migration utility that extracts a token from the URL password component of matching marketplace/source entries, converts it into an `Authorization: Bearer ...` header, removes credentials from the URL, and overwrites the user’s Claude marketplace configuration files atomically. There is no direct evidence of malware behaviors in this snippet (no network calls, no command execution), but it performs security-sensitive handling and persistence of authentication material and suppresses errors, so its behavior should be reviewed in the broader context of how/why `moveTokenToHeader()` is invoked.