eventhouse-cli

The code is an administrative Azure Data Explorer utility, not apparent malware. Its primary security issue is unsanitized interpolation of $BlobUri into a Kusto management command, which can enable Kusto command injection when the parameter is attacker-controlled. Unrestricted $ClusterUri also permits directing authenticated requests to an unintended endpoint. Validate the cluster against an allowlist, require and validate an https Azure Blob URI, and safely construct or escape the Kusto command before use.

The code appears to be a legitimate administrative script, not malware. It safely constructs the JSON transport body, but it does not validate or escape values embedded in Kusto commands. Untrusted table or policy arguments could modify the intended management command, and the unrestricted cluster URI could redirect authenticated requests. Inputs should be constrained to expected formats and the cluster URI should be allowlisted before use.