pdf-processor

No clear malicious payload or backdoor behavior is present. The code is primarily an OCR API client that uploads PDFs with a bearer token, polls and downloads OCR JSONL, parses it into layout/text structures, and optionally downloads remote preprocessed images to correct page orientation/unwarping before producing layered PDFs/dumps. The key risks are security-policy/reliability issues rather than overt malware: possible SSRF/network pivot via URLs embedded in untrusted JSONL (pp_images/img_url -> http_get_bytes) and use of tempfile.mktemp (TOCTOU). Malware confidence is therefore low, but supply-chain/runtime risk remains due to network fetching and data exfiltration to a configurable endpoint.