chrome-cdp

No obvious classic malware indicators (no obfuscated payloads, hardcoded credentials, reverse shells, or direct external C2/exfiltration in this module). However, this code is security-sensitive: it deliberately enables high-privilege browser automation by executing attacker-controlled JavaScript in the page context (CDP Runtime.evaluate) and allowing arbitrary CDP method execution (evalraw), and it exposes these capabilities via an unauthenticated local IPC socket/pipe. If an attacker can reach the daemon IPC or invoke the CLI in a user context, they can potentially navigate, interact, and capture content from the victim’s browser session. Use only in trusted/local-only scenarios with strict access controls around the IPC endpoint and execution context.