rabbit-rewrites

This fragment itself does not show explicit malicious behavior (no networking/subprocess/credential theft in the visible code), but it establishes an arbitrary-code-execution path by dynamically executing a local helpers.py via exec_module during pytest lifecycle hooks, while also manipulating sys.path and overwriting sys.modules['helpers']. The true security risk hinges on the contents of helpers.py; if that file is compromised or malicious, code will run repeatedly in the pytest process.

This module is primarily an orchestrator/test utility, but it contains a powerful mechanism to dynamically execute local Python files from computed filesystem paths (spec.loader.exec_module) while also mutating sys.path and sys.modules. No explicit malware behavior (exfiltration, credential theft, subprocess/system damage) is observable in this fragment itself, yet the execution pathway makes overall risk highly dependent on whether the referenced scripts (scripts/bench.py and rabbit-writes/scripts/scan.py) are trustworthy and integrity-protected. Treat as moderate-to-high supply-chain execution risk pending review of the loaded target files.