wlzh-youtube-tracker

This is a YouTube monitoring and Telegram notification utility. Its metadata transmission is consistent with its apparent purpose, so the fragment does not provide clear evidence of malware. However, shell commands are built with exec/execSync and interpolate the proxy environment value and bot token without shell-safe argument handling; crafted values can enable command injection. Prefer spawn/execFile with argument arrays and avoid shell evaluation.