wechat-mp

No clear malware/backdoor behavior is evident in this fragment; it is an API helper that uploads local images and creates drafts through explicit HTTP calls. However, it has a significant security risk: the request destination (API_BASE) is controlled by environment variables with no domain validation, so if those env vars are attacker-influenced the tool can exfiltrate credentials (appid/secret) and local image bytes to an arbitrary host. Additionally, the token subcommand prints access tokens to stdout, increasing the chance of token leakage via logs/CI artifacts. The HTML <img> parsing regex appears incomplete in the provided snippet, limiting certainty about how thoroughly local image sources are discovered, but the core exfiltration-relevant upload path remains clear.