im-up

This module is not obviously malware by itself (no networking, persistence, or explicit theft code), but it contains an intentionally powerful and security-sensitive mechanism: it executes shell commands (shell=True) supplied by external JSON configuration and can also execute packet-derived “verified” command probes when they match a config-derived allowlist. If attackers can influence the packet or especially the config/allowlist content (common in supply-chain/CI contexts), this becomes a practical RCE and local information disclosure risk via captured command stdout/stderr included in the JSON receipt. Secret/placeholder scanning is present but does not mitigate the command execution threat.