rollinggo-hotel-booking

No direct malware behaviors (e.g., exfiltration, backdoor installation, eval-based execution) are present in this fragment. However, it performs high-risk supply-chain actions: installs a global npm package using an unpinned '@latest' version (which may trigger install lifecycle scripts) and downloads a remote executable binary from GitHub Releases without any integrity verification, then marks it executable. These patterns warrant security review, pinning, and artifact verification.