baoyu-post-to-wechat

This module appears to be a legitimate WeChat publishing CLI, but it has meaningful security risk. The primary concern is the ability to fetch arbitrary http(s) URLs provided in untrusted HTML (and via --cover/frontmatter) and then upload the fetched bytes to WeChat, enabling SSRF-like abuse and unintended data exfiltration if an attacker can influence the input HTML/cover URL. A secondary concern is the runtime execution of a renderer through 'npx -y bun', which increases supply-chain/toolchain exposure at execution time. No direct, clear malware/backdoor behavior is evident from the provided code alone.