sdk-adoption-tracker

The code appears to be a legitimate GitHub SDK-adoption reporting tool and contains no clear malware or supply-chain backdoor. The principal security issues are disabled TLS certificate verification, which exposes the GitHub token and API traffic to man-in-the-middle attacks, and unvalidated user-controlled output paths that can overwrite local files. It also aggregates public personal and organizational metadata, creating a privacy consideration. TLS verification should be enabled and output paths should be constrained or explicitly confirmed.