embedded-captions

The code is a legitimate local animation preview and screenshot-generation utility. It contains no clear malware, credential theft, persistence, destructive behavior, or deliberate exfiltration. However, rendering untrusted project HTML with Puppeteer launched using disabled web security and allowing most network requests can permit project content to access resources or send data in ways that would normally be restricted. The tool should only process trusted projects, or use stronger isolation such as a sandboxed browser, blocked outbound networking, and stricter file/resource controls.

This module is a local rendering/measurement harness with no explicit data-theft/exfiltration behavior visible. However, it has meaningful security risk due to (a) dynamic discovery and require() of Puppeteer from filesystem locations influenced by process.env.HYPERFRAMES_ROOT and broad directories (possible dependency-path poisoning/loader abuse), and (b) weakened browser security flags while executing a user-supplied local index.html, plus injecting a locally discovered JS payload (gsap.min.js) into the page via evaluateOnNewDocument. Use only with trusted projectDir and trustworthy dependency paths/checkout contents.

This code is primarily a local image/layout analysis CLI. It does not show direct malware behaviors (no networking, credential theft, or obvious persistence). However, it introduces a notable security risk: it dynamically resolves and requires 'sharp' from non-standard/writable filesystem locations (including HYPERFRAMES_ROOT and a user Downloads path), and it spawns a child Node process with an attacker-controlled project directory argument. If an attacker can influence those search roots/contents or the project directory processed by the child script, they could potentially achieve unintended code execution via the dependency or via measure-layout.cjs behavior. Otherwise, for trusted environments and inputs, the operational risk is low.