nocobase-workflow-manage

This is documentation for an intentional server-side scripting feature, not malicious code. No direct malware indicators are present. The main security risk is architectural: allowing untrusted scripts to use configured Node.js modules and a node:vm environment may permit filesystem, environment, network, or process access if isolation and authorization are insufficient. Unrestricted execution time also creates a potential resource-exhaustion risk. Treat script authors and WORKFLOW_SCRIPT_MODULES configuration as highly privileged inputs.