lov-media-crawler

No direct evidence of covert malware behavior (no eval/exec payloads, no persistence, no exfiltration to arbitrary domains, no command/control). However, the tool executes an external upstream repository (MediaCrawler) via `uv run` after fetching it from GitHub—this is a substantial supply-chain/code-execution risk area. Additionally, it reads an authorization cookie from the environment or macOS Keychain and sends it to resolver endpoints, which increases the impact if those endpoints or traffic are compromised.

This module is an authorization automation helper: it drives a visible login to yuanbao.tencent.com, extracts session cookies, uses a helper function to resolve feed information with the cookie-derived header, and—when successful—stores that cookie/header into the macOS Keychain via the `security` CLI. There is no direct evidence of malware (e.g., reverse shells, destructive actions, or explicit network exfiltration to unknown destinations) within this snippet. The primary security concerns are (1) handling and persistence of highly sensitive authentication material (cookie/header) into the Keychain, (2) passing that material into an external helper (resolve_wechat_direct) whose behavior is not shown here, and (3) modifying sys.path to import local code (potential module shadowing if the directory is not trusted). Recommend reviewing media_crawler/resolve_wechat_direct for any unexpected network destinations or logging/serialization of credentials, and ensuring the runtime import path cannot be influenced by untrusted content.