building-github-index-v2

No direct evidence of intentional malware (no execution of fetched code, no subprocesses, no credential/secret access, and no suspicious outbound network beyond fetching a GitHub tarball). However, the module contains meaningful security weaknesses: it extracts untrusted tarball contents with tar.extractall(tmpdir) without path/symlink validation (path traversal/overwrite risk) and it can write an index to an arbitrary user-supplied output path (arbitrary file overwrite within process permissions). These issues are the primary threat signals for supply-chain ingestion tooling.