web-search

This module is primarily a fingerprint spoofing/anti-detection utility for automated browsing: it crafts synthetic locale/UA/hardware signals, sets corresponding HTTP headers, and injects code to override high-signal browser APIs (navigator/window/screen/chrome and permissions.query). It also executes a locally resolved browser binary to read --version, which is not inherently malicious, but becomes a potential local execution risk if resolveBrowserBin/preferredBin/env are attacker-influenced. No direct exfiltration or credential theft is visible in this file.

This module does not show overt malware characteristics (no obfuscation, no dynamic code execution like eval, no hardcoded credentials, no direct third-party exfiltration). However, it has inherently sensitive capabilities: it can spawn a detached background process based on caller-controlled scriptPath/arguments and uses environment-influenced launcher selection, and it can dispatch arbitrary command/payload JSON to a daemon endpoint over HTTP. The primary security concern is trust-boundary control over inputs (scriptPath, forwardedArgs, env, daemonUrl, daemonPidFile) and the daemon’s authorization model for the /command endpoint. If an attacker can influence these inputs or endpoints, this could become an arbitrary execution/command dispatch primitive.