No confirmed malicious attack surface. The CLI reads user-selected Markdown (or stdin) and, only with --fix, rewrites those selected regular files locally.
Static reason
No blocking static signals were detected.
Trigger
Explicit lint-md CLI invocation; writes require --fix.
Impact
No exfiltration, persistence, remote execution, or install-time mutation established.
Mechanism
Local Markdown linting with optional in-place fixes.
Rationale
The shipped code is a user-invoked local Markdown linter with guarded optional file rewriting. Source inspection found no concrete malicious behavior.
Evidence
package.jsonlib/src/lint-md.jslib/src/utils/load-md-files.jslib/src/utils/lint-worker.jslib/src/utils/safe-write-file.jslib/src/utils/batch-lint.js