preview-md

No clear indication of intentional malware (low malware likelihood), but the module presents substantial security risk for local usage with untrusted input. It enables arbitrary local file reads via unprotected endpoints (/api/content and /api/file) using user-supplied paths, and it injects Markdown-derived HTML into the DOM via marked.parse + innerHTML without explicit sanitization, creating potential XSS/injection risk. Exec(open/xdg-open) is an additional elevated sink, though likely low impact in typical trusted local use.