wx-mp-hunter

This code is a repeating external-process launcher that is configured via unvalidated command-line inputs (especially the executable selected via argv[3]) and instructs the spawned tool to run an eval-like action while suppressing all output and swallowing errors. In isolation it shows no explicit exfiltration, but the combination of arbitrary executable selection, eval-like command arguments, and stealthy observability strongly warrants security review of invocation controls and the behavior of the external CLI.

Overall, this module is not typical malware (no clear backdoor/exfil to attacker-controlled domains), but it is security-sensitive automation that harvests and persists WeChat authentication material (cookies + token + UA), prints the token to stdout, and uses a powerful camoufox-cli interface with an eval-like command. The biggest concrete risk in this fragment is that cmdFetch() accepts arbitrary URLs and sends the authenticated cookie jar to that URL, which can cause credential leakage if misused or if upstream tooling passes untrusted URLs. Treat the package as high-risk for privacy/account-abuse and review how it is deployed and how inputs (especially --fetch url) are controlled.