read-news

Primary finding: the module performs dynamic JavaScript execution (new Function) on a substring extracted from untrusted remote HTML (AF_initDataCallback payloads). This is a high-severity security design flaw because it can enable arbitrary code execution in the consuming application under realistic threat models (response manipulation, upstream compromise, or unexpected embedded payload changes). No clear evidence of overt malware behaviors (e.g., exfiltration/backdoors) is visible in this snippet, but the execution primitive makes the overall supply-chain security risk high.