motion-video-maker

No direct evidence of malware (no network exfiltration endpoints, no credential theft, no process-spawning, no obvious obfuscated logic) is present in this module. The primary security concerns are operational: it loads a local file URL derived from CLI input while running Chromium with '--no-sandbox' and '--allow-file-access-from-files', which can substantially increase impact if the loaded HTML or its dependencies are attacker-controlled. It also extracts DOM text and prints it to stdout, which can leak sensitive content if present in matched elements.

No explicit malicious payload (e.g., credential theft, hidden network exfiltration, reverse shell, filesystem damage) is present in this snippet itself. However, the module is security-sensitive because it loads attacker-influenced local HTML into a Chromium instance with weakened hardening ('--no-sandbox' and '--allow-file-access-from-files') and then executes/coordinates via page-defined globals. Additionally, it writes screenshots to an unvalidated output path, which can enable arbitrary file overwrite/write within the permissions of the runner. Overall: treat as risky if argv[2] or argv[4] can be influenced by an attacker or if the HTML content is not fully trusted.