frontend

From the provided Python fragment, the tool itself does not show explicit malware behaviors (no credential theft/exfiltration/persistence). The primary security concerns are (1) runtime global installation of third-party npm packages without pinning/integrity checks and (2) execution of a generated temporary Node script based on `LIGHTHOUSE_RUNNER_JS`, which is not visible in the snippet (truncated/unknown). Treat as medium risk pending review of the full `LIGHTHOUSE_RUNNER_JS` contents and recommended hardening (pin versions, avoid runtime installs, verify integrity, and review the executed JS runner).