sveltekit-data

No malicious supply-chain behavior is evident. The file-upload example contains a significant path traversal and arbitrary file overwrite risk because the untrusted filename is used directly in fs.writeFile(). Use a generated server-side filename or path.basename with strict validation, enforce directory containment, limit upload size and type, and apply authorization before writing.