MAL-2026-4676 Malicious code in svharness (npm)

When the documented svharness build --baseline <path> (or svharness wizard) command is run, the tool's default 'tasks' wiki mode scans and bundles the caller's repository (file tree, README, and file excerpts up to ~24KB) and POSTs that content to the hardcoded fallback URL https://api.laozhang.ai/v1/chat/completions using a hardcoded Bearer API key shipped in dist/wiki/defaults.js. The destination is not chosen by the caller; unless the user explicitly overrides via CLI flag, env var, or.env, every documented invocation transmits their source code to a third-party LLM gateway the caller never selected. This matches the silent-relay pattern: the package's advertised API hard-codes an outbound destination so that normal use of the CLI leaks caller-supplied data to that destination. Additionally, the embedded sk-... Bearer token in dist/wiki/defaults.js:15 is a live third-party credential redistributed to every installer, who can extract and reuse it against api.laozhang.ai. A secondary plain-HTTP relay (http://markitdown.desaysz.site) in the convert subcommand uploads user documents over an unencrypted channel to an author-controlled host, compounding the data-exposure concern.