msw-handlers

The code has a credential-handling issue: it places the token in the URL query string instead of the required Authorization: Bearer header. The tests do not detect this because their fetch stubs ignore request arguments. No evidence of intentional malware or obfuscation appears in the supplied code.