foundry-vtt-module-dev

The code does not show intentional malware or supply-chain sabotage. It contains a significant authorization design flaw: a GM client executes privileged operations based on unauthenticated socket messages. Depending on Foundry socket semantics and deployment configuration, any connected client may be able to modify arbitrary actors, create arbitrary items, delete items, or trigger roll messages. Requests should include authenticated user context where available and be validated against explicit permissions, actor ownership, allowed fields, item schemas, and safe roll formula constraints.