Art

This is an image-generation CLI, with no clear evidence of intentional malware or unrelated data exfiltration. It sends prompts and explicitly selected images to the chosen providers and sends generated images plus REMOVEBG_API_KEY to https://api[.]remove[.]bg/v1.0/removebg when background removal is enabled. The principal security issue is command injection through crafted --output paths passed to child_process.exec in addBackgroundColor; severity is high when untrusted users can supply those paths. It also permits overwriting files at the selected output path.