easyeda-api

SUSPICIOUS: the skill is mostly coherent with its stated EasyEDA automation purpose and uses local-only bridge flows, but it grants high-impact code-execution capability inside EasyEDA and depends on an externally distributed compiled .eext extension with limited verification evidence. Not malicious on the provided evidence, but it carries meaningful supply-chain and execution risk.

This module is not overtly obfuscated or performing classic malware behaviors (no exfiltration, no eval, no process/file tampering), but it is security-sensitive: it exposes unauthenticated endpoints/WS messages that accept arbitrary code and forward it to an EDA client for execution. Coupled with permissive CORS ('*') and lack of authorization for window selection/execution, the main concern is unauthorized local code execution (primarily by local attackers or malicious localhost calls via the user’s browser).