@ZhaoAndy821/dsh-motion-background

The path is wrapped in single quotes but never escaped, and it is inserted into a string that powershell.exe parses as a command. A directory under D:/tmp (or os.tmpdir()) whose name contains a single quote, e.g. "x'; Start-Process calc; '", breaks out of the literal and executes arbitrary PowerShell as the user running verify.mjs. The only filter is a self-declared owner marker whose shape check the code itself documents as "not a forgery proof" (o.tool==='verify.mjs', integer pid, nonce>=8 chars), so an attacker with write access to the shared temp dir can satisfy it and set pid to a dead va

cleanCopies() enumerates D:/tmp and passes the joined path straight into a PowerShell command. Identical injection primitive to verify.mjs: a crafted directory name plus a forged .mb-verify-owner.json (checked only by ownerOf(), whose shape test is self-declared) yields PowerShell execution as the invoking user when mutations.mjs is run; the same call also force-deletes, with -Recurse -Force, any directory an attacker has marked as belonging to the tool.

Deletion runs as a module-level side effect at import time, not behind a command-line flag, over TMP_BASE = existsSync('D:/tmp') ? 'D:/tmp' : tmpdir(). Any directory there that merely contains a correctly shaped .mb-verify-owner.json with a dead pid is recursively force-deleted; the ownership marker is documented in-file as a self-declared claim and not a forgery-proof credential, so third-party data in a shared temp directory can be destroyed by a tool that was never explicitly asked to clean up.