exportdou

The workflow contains no direct malware behavior such as credential harvesting or command execution from the downloaded file. However, downloading unpinned external content into a test-controlled release pipeline is a notable supply-chain risk. A compromise of exportdou.cn or its response could affect npm test and, depending on repository behavior outside this fragment, potentially influence what is published. The remote file should be vendored, pinned and integrity-checked, or fetched only from a trusted reviewed source.