code-runner

This is an explicit multi-language code execution utility, not evidence of malware in itself. Its primary security risk is inherent: code runs with the caller process's permissions and inherited environment, without sandboxing. Use only with trusted code or inside an appropriately isolated environment.

No evidence of concealed malicious behavior is present. The principal risk is inherent arbitrary-code execution: any untrusted benchmark input runs with the invoking user's permissions. Use only with trusted code; this is a significant design risk if exposed to untrusted users.

No evidence of embedded malware. The utility intentionally evaluates user-provided JavaScript, which enables arbitrary code execution in the Node.js process and is unsafe when expressions come from an untrusted source. For trusted, local CLI input this appears to be the tool's intended behavior.