qiniu-kodo

No direct evidence of intentional malware is present in this fragment (no backdoor/exfiltration logic is observable). However, the script materially increases security risk by persisting plaintext cloud credentials to disk and especially to shell startup files, by using Node require() for config “JSON validation” (which can become code-execution if the file is attacker-controlled), and by installing/downloading third-party components without integrity controls (unpinned/unverified npm packages and an unverified downloaded qshell binary). Overall: treat as a credential-handling and supply-chain-hygiene risk that warrants hardening (safe JSON parsing, secret redaction, and artifact/package integrity verification).

No direct evidence of overt malware behavior (no backdoor/persistence/stealth networking) in this file’s logic. However, the module introduces a significant supply-chain security risk by performing a runtime `npm install` of the 'qiniu' dependency using a semver range (^7.14.0) without integrity pinning, and then immediately `require()`s the installed code from a cache directory that can be influenced via --cache-dir or QINIU_KODO_CACHE_DIR. This makes execution non-deterministic and increases the impact of registry compromise, typosquatting, or local cache tampering. The upload/test functionality itself is straightforward and intended (outbound upload/listPrefix calls to Qiniu).