data-transform

No clear malware behavior is present. The main risk is intentional arbitrary JavaScript execution through --map and --filter; untrusted expressions can perform actions available to the Node.js process. Treat these options as code execution, not as a sandboxed expression interface.