libvips-image

The code is a conventional Windows installer with legitimate libvips and pyvips installation behavior. It does not show clear malware, data theft, backdoors, or destructive activity. However, it has meaningful supply-chain risk because it executes an unverified remote PowerShell script, trusts an unverified downloaded binary archive, installs an unpinned Python package, and uses Invoke-Expression for pip execution. Review or harden these behaviors before use in a high-assurance build environment.