acestep-simplemv

The code appears to be a legitimate Remotion music-video rendering utility, not malware. It contains a significant command-injection risk because user-controlled paths and options are interpolated into shell commands executed with execSync(). It also permits unsandboxed lyric file reads and lacks explicit traversal validation for relative asset paths. Use argument-array APIs such as spawnSync/execFileSync without a shell, validate codec and output values against allowlists, and enforce intended directory boundaries.