keeper-secrets

No malicious payload or intentional supply-chain attack is evident in this documentation. The main risks are operational: transporting KSM credentials through environment variables, treating base64 as protection, writing resolved secrets to plaintext files, possible secret leakage from logging, and incorrect or incomplete assumptions about automatic resolution in AWS Lambda and services that do not run ksm exec. These issues warrant documentation and deployment hardening but do not indicate malware.