codex-theme-switcher

No direct evidence of classic malware (exfiltration, credential theft, cryptomining, or backdoor persistence) is present in this fragment. However, the library/tool performs high-impact, dynamic code injection into a local renderer via CDP (Page.addScriptToEvaluateOnNewDocument and Runtime.evaluate) using JS source derived from theme/manifest data. If a supply-chain attacker can influence theme contents or identifiers/state, this becomes effectively arbitrary code execution in the target app context. This is a security hotspot that should be reviewed for strict input validation and sandboxing (themeDir resolution, manifest.id/backgroundScope constraints, and any controls on theme provenance).