kelly-listing

This module is a legitimate-looking deployment/publishing CLI, but it performs a high-impact bulk read-and-upload of nearly all files under a local directory to Busabase via publishAirApp. There is no obvious malware/backdoor logic in the snippet; however, the broad file selection without extension/type allowlisting makes accidental or abusive data exfiltration/publishing plausible if sensitive artifacts exist under appRoot or if credentials point to the wrong workspace.