tether

No explicit malicious logic (obfuscation, credential theft, keylogging, direct exfiltration) is present in this fragment. The primary supply-chain/security concern is that it dynamically loads and executes bridge_runtime.py from a user-writable data directory without integrity/ownership verification, enabling arbitrary code execution if that file is tampered with. Additionally, it may execute an attacker-controlled Hermes binary if environment variables are compromised. Overall: malware is not evidenced here, but the trust model is risky and should be reviewed alongside bridge_runtime.py and the Hermes plugin behavior.