visual-design-system

This CLI generates an HTML infographic preview and is not evidently malware; however, crafted specifications can inject JavaScript through unescaped `${...}` in the embedded template literal, and crafted titles can inject HTML when the output is opened. It also loads a mutable third-party script from unpkg without integrity protection, permits template-path traversal to `.txt` files, and writes to the caller-selected output path. Severity is moderate when untrusted inputs are used; no credentials or system data are explicitly targeted.

This script generates an HTML Vizzu animation from a JSON payload and writes it to the specified path. Attacker-controlled payloads can inject markup or JavaScript through the unescaped title or by terminating the inline script, and can select an output path to overwrite accessible files; severity is context-dependent and elevated if inputs are untrusted. The generated page also imports Vizzu from https://cdn.jsdelivr[.]net/npm/vizzu@0.9/dist/vizzu.min.js. No clear malware behavior is present.

The intended utility applies a selected function to subtitle lines, but unrestricted eval() of the --func command-line argument permits arbitrary Python code execution when that input is untrusted; --module also permits importing caller-selected modules. No specific malware behavior, network endpoint, or credential theft is shown. Severity is high for untrusted invocation, although the pasted fragment is syntactically invalid because the examples dictionary entry has no value.