dev-serve

The code is a development-server and reverse-proxy management utility. It intentionally executes package.json or DEV_CMD content and modifies Caddy and Vite configuration, so it should only be used with trusted repositories and validated configuration values. Input interpolation creates injection and configuration-corruption risks, especially through unusual repository names, domains, or a remotely configured CADDY_ADMIN endpoint. No clear malicious behavior, credential theft, obfuscation, persistence, or suspicious exfiltration is present.