im-down

This module is not obviously malware by itself (no networking, persistence, or explicit theft code), but it contains an intentionally powerful and security-sensitive mechanism: it executes shell commands (shell=True) supplied by external JSON configuration and can also execute packet-derived “verified” command probes when they match a config-derived allowlist. If attackers can influence the packet or especially the config/allowlist content (common in supply-chain/CI contexts), this becomes a practical RCE and local information disclosure risk via captured command stdout/stderr included in the JSON receipt. Secret/placeholder scanning is present but does not mitigate the command execution threat.

This code is a manifest/packet generator, but it also executes arbitrary shell commands specified directly in an external JSON config using subprocess.run(..., shell=True) without validation. While there is no explicit malware/backdoor/exfiltration logic in this snippet, the arbitrary command execution sink makes the module potentially dangerous in supply-chain contexts where the config can be influenced. Treat it as a high-risk runner unless config and receiver_checks are strictly controlled and integrity-protected.