just-bash-executor

The code is primarily an SDK loader/compat layer that dynamically rewrites and executes JavaScript modules from base64 data: URLs, and it shims '@executor-js/api'. It does not contain explicit malware behaviors (no exfiltration, no credential theft, no process spawning), but it introduces a high-impact dynamic code execution mechanism and passes attacker-controlled configuration into network-capable plugins (graphql/openapi/mcp), which could become dangerous depending on how queuedSources are sourced. Treat as medium security risk with moderate malware likelihood due to the powerful data: import pattern.