motion-studio

No clear malware, credential theft, persistence, or exfiltration behavior is present. The main security concern is unsafe HTML/SVG construction from caller-provided values, which can cause DOM injection or XSS when those values are untrusted. Global time and randomness overrides can also affect host-page behavior. The fragment appears syntactically invalid at OV.hud, preventing execution as provided.

This is a package-vendoring utility, not evidently malware. It has security risks from unsafe tar extraction and unvalidated file paths. Treat packages and file-path arguments as untrusted; use safe extraction and enforce that resolved source paths remain within the package directory.