record-screen

This is a Chrome screen-recording bridge, not clearly malware, and it contains no evident credential theft or external exfiltration. However, the unauthenticated server on port 9234 may be reachable beyond localhost and exposes tab listing, recording controls, and an unauthenticated WebSocket peer; callers can also choose the FFmpeg output path, creating a serious exposure if the service is network-accessible. Restrict the listener to loopback and authenticate or otherwise validate API and WebSocket clients; validate output paths and cap request sizes.

This code implements a browser-screen recording bridge that exposes tab titles and URLs and streams visible-page screenshots to ws://localhost:9234 when commanded. The local endpoint and recording behavior may be intentional, but the code shows no authentication or validation of the WebSocket peer, so a reachable local service could trigger capture or obtain sensitive browser content. Severity is moderate to high depending on the bridge’s exposure and trust model; no clear evidence of malware is present in this fragment.