chrome-cdp

No clear evidence of hidden malware (no exfil to external domains, no persistence/backdoor beyond its intended daemon, no obfuscated payload). However, the module is inherently high-risk from an abuse perspective: it provides command-driven execution in the controlled browser via Runtime.evaluate (eval/html/click/loadall) and arbitrary CDP invocation via evalraw, and it exposes an unauthenticated local IPC server that can be controlled by anyone who can access the socket/pipe. It also writes files for screenshots and page cache, with optional caller-controlled output paths.