video-motion-previs

No direct evidence of data theft/backdoors in this module (no keylogging, clipboard access, or remote exfiltration). However, there is a significant supply-chain/remote-code-execution trust issue: on macOS the CLI downloads a shell script from a raw GitHub URL and executes it without checksum/signature verification. Additionally, source installation clones the repo default branch at depth=1 and runs `npm ci`, which may install changing upstream content. These behaviors warrant review/hardening (pin to commits, verify signatures/checksums, and/or avoid auto-executing downloaded scripts).