cad-viewer

This module is a CAD generation orchestrator that dynamically loads and executes Python generator plugins from a filesystem path (exec_module + generator() call). It validates the *returned payload structure* but cannot restrict what the plugin code does during import/execution. No explicit overt malware (network exfiltration, credential theft, reverse shell) is visible in this fragment; the primary risk is the inherent arbitrary-code-execution trust boundary, which would enable build-time sabotage or data theft if an attacker can influence the generator module path/content. Truncation at the end of the file slightly limits review of cleanup/lock semantics.

No direct evidence of embedded stealth malware, network exfiltration, or obfuscation is present in this module. However, the tool dynamically imports and executes code from a local path provided via --source-path, creating a potentially high-impact arbitrary code execution risk when inputs are not strictly trusted. Additionally, it writes binary GLB artifacts to filesystem locations derived from --package-dir and optional --write-glb without visible allowlisting/sandboxing in this snippet. This should be treated as a sensitive build/conversion CLI that requires strict input control and controlled execution context.

This dependency implements a loader hook that writes a log of locally loaded file:// module paths to a destination file configured via initialize(data). There is no evidence of network exfiltration, code execution, or credential theft in this snippet. However, the design allows configurable filesystem appends without validation of logPath and records potentially sensitive local filesystem paths (module/file provenance). Silent error suppression further reduces detectability, so the main security concern is privacy/path disclosure and potential arbitrary file append within the process’s permissions.

This module is a minimal bootstrap that registers a local Node.js resolution hook (node_resolve_hooks.mjs) using the privileged node:module register mechanism. While the snippet itself shows no explicit malicious actions, the hook-based approach is high-impact and can be used to alter dependency resolution/execution, making it a supply-chain/runtime tampering red flag pending review and verification of node_resolve_hooks.mjs (content, integrity, and whether it only performs intended legitimate resolution behavior).