paw-mkt-dashboard

The code is a legitimate dashboard reference implementation and contains no clear malware or supply-chain backdoor. The primary security issues are an unsanitized Markdown-to-{@html} flow that can produce stored XSS, and an import endpoint that dynamically interpolates filenames and JSON keys into SQL while lacking visible access control. Normal campaign CRUD values are parameterized. The import implementation should use a strict table allowlist, validate column names against per-table schemas, validate row types, handle parse errors, and require authentication/authorization. Markdown should be sanitized with an appropriate HTML sanitizer before rendering or rendered without allowing raw HTML. No external exfiltration, credential theft, persistence mechanism, or obfuscated payload is present.