elasticsearch-file-ingest

No strong evidence of embedded malware, credential theft, or covert exfiltration in this file itself. The primary security concern is the high-impact design feature that executes a user-specified JavaScript module via import()/require() when --transform is used, which can lead to arbitrary code execution if the CLI argument or transform source is untrusted. Treat this CLI as unsafe in multi-tenant or untrusted-invocation scenarios unless --transform is tightly controlled.