course-digest

This module is a network downloader/collector that is security-relevant primarily due to two supply-chain adjacency issues: (1) manifest-controlled URLs and redirects are fetched without host/redirect restrictions (SSRF-like risk and redirect amplification), and (2) manifest-controlled `label` values can directly influence the output filename used in `join(targetDir, filename)` and `writeFileSync`, creating a potential path traversal/arbitrary file overwrite risk if manifests can be tampered with. There is no direct evidence of stealthy malware execution or data exfiltration in this snippet, but it should not be run against untrusted/attacker-controlled `resources.json` content without strict validation/sanitization and network allowlisting.

This file is a thin bootstrap that registers a local Node.js resolve/loader hook. The snippet itself contains no direct malicious logic, but loader/resolve hooks are powerful and can be used for dependency substitution or runtime tampering. The overall security assessment hinges entirely on the contents/behavior of resolve-hook.mjs, which is not provided here. Review resolve-hook.mjs for any import redirection, dynamic module replacement, network communication, or data handling.