rankup

No clear malware behavior is visible. The significant security issue is that the user-controlled --script name can traverse outside DEMAND_DIR and cause an arbitrary accessible .mjs file to be executed by --auto. The fragment also appears incomplete or malformed as provided. Restrict script paths to the intended directory and verify the complete source before use.

This CLI automates Ahrefs project management and optional Cloudflare DNS ownership verification; no clear malware or unauthorized data exfiltration is evident. It has a security warning: interpolated command-line values reach execSync shell commands, and site is inserted into browser-evaluated JavaScript without escaping, enabling injection if an untrusted party can control arguments. The explicit DNS and data-key handling are consistent with the advertised features; severity is moderate because the tool can alter DNS and write to a caller-selected file.

This script automates Naver Search Advisor using an existing authenticated browser session and saves evidence locally. It does not show clear malware behavior or unrelated data exfiltration, but untrusted --session, --site, or --sitemap-url values can reach shell commands, and --site also reaches evaluated browser JavaScript, creating command- and code-injection risks. The intended remote service is searchadvisor[.]naver[.]com; severity is moderate and depends on whether arguments are trusted.

This module is a DOM automation helper that also implements a strong clipboard/text harvesting capability: during a capture window it installs a document 'copy' listener to read clipboard contents and monkey-patches navigator.clipboard.writeText to record text written to the clipboard, then exposes the captured content through a globally accessible window.__rk API. Even without visible network exfiltration in this snippet, the harvested data is readily retrievable by any co-resident script, creating a significant supply-chain security risk.

The code appears to implement a legitimate domain-reporting CLI and contains no clear embedded malware, credential theft, persistence, or destructive behavior. However, it has a high-impact command-injection vulnerability in the 404 fallback and a path-traversal risk in report storage because the domain is not validated or safely passed to the shell/filesystem. The runtime `npx` execution also creates a supply-chain exposure. Domain input should be strictly hostname-validated, filesystem components should be safely encoded or constrained, and the CLI should use spawn/execFile with an argument array and a pinned dependency.

The code is a browser-based Microsoft Clarity project setup utility, not clearly malware. However, --session is interpolated unsafely into a shell command executed by execSync, allowing command injection if an attacker can control that argument. Avoid untrusted session values and replace shell-string execution with an argument-array API or strict validation.

The main security issue is JavaScript injection through the unescaped command-line domain interpolated into browser-evaluated source. Exploitation requires a crafted domain argument and affects the browser page context. Output file writing is an explicit CLI feature. No clear malicious intent or independent data exfiltration is evident.

The code is an administrative browser-automation script, not evidently malware. However, --session is interpolated unsafely into an execSync shell command, creating a command-injection risk if that argument is attacker-controlled. It also submits consequential URL-removal requests to Google Search Console.

No clear malware or data theft behavior is evident. The utility has security risks if its configuration or remote sitemap content is untrusted, particularly unrestricted URL fetching, site-name path traversal in snapshot writes, and unbounded response processing.

The code appears to implement an API client, not malware. Its principal security concern is potential API-key disclosure if apiGet receives an untrusted absolute pathname or if ANYWAY_API_BASE is attacker-controlled. Restrict request URLs to the configured origin and validate the base URL before attaching credentials.