embedded-captions

This is a media-composition generator that reads project/theme data and writes HTML layers plus an FFmpeg post-processing script. No direct malware, credential theft, or network exfiltration is evident; the pinned GSAP CDN reference is consistent with the animation purpose. Malicious configuration can inject content into generated browser documents and potentially shell substitutions into _postfx.sh, which become security risks if the output is rendered or the generated script is executed. Severity is moderate and dependent on trusting the project configuration and generated artifacts.

No clear indicators of intentionally malicious runtime behavior in this module (no network calls, credential theft, or persistence). The security risk is primarily that untrusted plan.json and/or DNA-derived tokens/CSS fragments are embedded into generated HTML/CSS via raw string templating with incomplete escaping (word text only). Additionally, the tool executes ffprobe during compilation using paths derived from files discovered in the provided project directory. If an attacker can influence the project contents, they can potentially generate an index.html with HTML/CSS injection payloads and may be able to disrupt the build via ffprobe on crafted inputs.

This module is a local rendering/measurement harness with no explicit data-theft/exfiltration behavior visible. However, it has meaningful security risk due to (a) dynamic discovery and require() of Puppeteer from filesystem locations influenced by process.env.HYPERFRAMES_ROOT and broad directories (possible dependency-path poisoning/loader abuse), and (b) weakened browser security flags while executing a user-supplied local index.html, plus injecting a locally discovered JS payload (gsap.min.js) into the page via evaluateOnNewDocument. Use only with trusted projectDir and trustworthy dependency paths/checkout contents.

This code is primarily a local image/layout analysis CLI. It does not show direct malware behaviors (no networking, credential theft, or obvious persistence). However, it introduces a notable security risk: it dynamically resolves and requires 'sharp' from non-standard/writable filesystem locations (including HYPERFRAMES_ROOT and a user Downloads path), and it spawns a child Node process with an attacker-controlled project directory argument. If an attacker can influence those search roots/contents or the project directory processed by the child script, they could potentially achieve unintended code execution via the dependency or via measure-layout.cjs behavior. Otherwise, for trusted environments and inputs, the operational risk is low.