z-md-to-pdf

The module is a legitimate-looking setup script for Pandoc + TinyTeX/TeX packages, with verification-only mode support. It does not contain clear backdoor/exfiltration behaviors, obfuscation, or credential theft. However, it performs high-impact supply-chain sensitive actions: it downloads and extracts a TinyTeX “daily” archive from a remote repository without checksum/signature verification and then executes TeX tooling from the extracted content (after PATH modification). This should be treated as a supply-chain integrity risk and mitigated by pinning to a fixed release and verifying cryptographic hashes/signatures before extraction.