motion-graphics

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The bake-basemap helper (categories/maps/bake-basemap.mjs) injects a PAGE that at runtime loads and executes remote JS/CSS (e.g. https://cdn.jsdelivr.net/npm/maplibre-gl@5.24.0/dist/maplibre-gl.js and https://cdn.jsdelivr.net/npm/topojson-client@3.1.0/…, and it fetches world-atlas JSON at https://cdn.jsdelivr.net/npm/world-atlas@2.0.2/countries-110m.json plus third‑party tile endpoints like https://server.arcgisonline.com/ArcGIS/rest/services/World_Imagery/MapServer/tile/{z}/{y}/{x} — all fetched during the bake and required for the basemap bake), so remote content is executed/used at runtime as a required dependency.