metabase

This is a readable smoke-test script with expected filesystem and Metabase mutations. It has a command-injection risk because untrusted CLI arguments are interpolated into shell commands executed by execSync() without quoting or escaping; only run it with trusted arguments. The script also inserts field names into SQL without validation. No clear malware behavior is present in the fragment.

The code implements output projection and size limiting, but pathTree() has a prototype-pollution vulnerability through attacker-controlled field paths. No clear malware behavior is present. Use a null-prototype dictionary or reject special property names and require own-property traversal.

This is a local Metabase test setup script, not evident malware. It generates and locally stores test credentials, but has a command-injection risk if MB_TEST_IMAGE or MB_TEST_PORT can be controlled by an untrusted party. Running an untrusted configured Docker image is also risky.

The script appears intended as a test approval helper, but its unrestricted target URL can cause local admin credentials to be sent to an arbitrary host. An untrusted response can also specify a cross-origin form action that receives the session cookie. Restrict the target and action to an explicitly trusted origin before use.