rhdh-plugin-export

No clear malicious behavior (no backdoor/exfiltration/credential theft code) is visible in this module. However, it materially increases supply-chain and operational risk by executing external tooling chosen at runtime (including npx with an unpinned @latest CLI) and by enabling npm publish and OCI push using locally built/exported artifacts that depend on the plugin_dir contents and the environment’s credentials. This should be treated as a high-trust build/publish orchestrator and protected accordingly (pin tool versions, lock dependencies, validate plugin_dir provenance, and restrict publish/push permissions).