story-html-publisher

The code is a legitimate-looking storybook asset bundler, but it is unsafe for untrusted story metadata or command-line arguments. The primary risks are unrestricted remote image fetching (SSRF), path traversal/arbitrary local file reads, attacker-controlled output paths, resource exhaustion from unbounded reads, and possible title-based HTML injection. No direct malware behavior is evident in the supplied code.