polyhaven-assets

No clear malicious payload or intentional malware is present. The primary security concerns are arbitrary outbound URL access and unrestricted filesystem path construction in fetch(), which may permit SSRF and path traversal/file overwrite if callers can control its arguments.