tuzi-post-to-wechat

No direct evidence of classic supply-chain malware (no hardcoded credentials, no external exfiltration endpoints, no persistence/backdoor logic visible). However, the module is high-privilege automation code with multiple strong execution primitives: arbitrary JavaScript execution via CDP Runtime.evaluate() and additional injection risk from unescaped selector interpolation in clickElement(). It can also paste clipboard contents into pages and can spawn a local executable based on an environment override. Treat as security-sensitive: ensure only trusted callers can invoke it and strictly validate/sanitize url/selector/expression and the chrome executable path.

This code is a WeChat posting automation utility with significant security exposure due to (1) host-side command execution via execSync/spawnSync of an external browser automation tool and (2) repeated in-browser JavaScript execution via eval, where title/content and image paths are user-influenced. The fallback upload mechanism can read local files via file:// fetch in the browser context, then upload them through the UI. No clear backdoor or direct third-party exfiltration endpoints are evident in this file alone, but the overall design warrants strong supply-chain/input trust controls and careful review of the agent-browser binary’s command parsing and permissions.

This module is a dual-use cross-platform keystroke injection utility that performs a real paste (Cmd+V/Ctrl+V equivalents) to the active/frontmost application and explicitly aims to bypass synthetic paste-event detection. No network exfiltration or persistence is present in the provided code, but the behavior is inherently security-sensitive (UI input automation) and can be abused for clipboard-driven attacks. The highest concrete technical risk is on macOS: user-supplied --app is interpolated into dynamically constructed AppleScript executed via osascript without escaping/validation, creating an AppleScript-evaluation injection risk. Overall: elevated security risk; treat as high-impact automation code and restrict/validate inputs when used.

No clear malware, credential theft, or network exfiltration is present. The main concerns are an unvalidated theme-name path used for file reads and unescaped input incorporated into generated HTML/CSS. Risk depends on whether these arguments can be controlled by untrusted users and whether the generated document is rendered or exposed.