html-to-pdf

No explicit malware (e.g., credential theft, persistence, or direct remote exfiltration logic) is visible in the provided module excerpt. The primary security concern is capability expansion: the tool executes caller-influenced JavaScript inside a locally launched browser via CDP Runtime.evaluate (notably through a “ready expression”), while also running Chrome with relaxed file/origin access flags. If untrusted users can supply args.ready-expr/args.selector or if args.input contains hostile content, this can enable powerful browser-context manipulation and potentially network egress initiated by the loaded page. The snippet also appears corrupted/partial around wait_for_ready, reducing confidence in the exact behavior beyond the observed high-level flow.