video-style-cloner

The code appears to implement canvas rendering and export functionality. The significant security concern is indirect eval of string elements in renderSheet's at argument, which permits arbitrary JavaScript execution if an untrusted party can call this API with attacker-controlled input. No definite malicious behavior or exfiltration is shown in the provided fragment.

The code is a legitimate local animation preview and screenshot-generation utility. It contains no clear malware, credential theft, persistence, destructive behavior, or deliberate exfiltration. However, rendering untrusted project HTML with Puppeteer launched using disabled web security and allowing most network requests can permit project content to access resources or send data in ways that would normally be restricted. The tool should only process trusted projects, or use stronger isolation such as a sandboxed browser, blocked outbound networking, and stricter file/resource controls.

This module is a local rendering/measurement harness with no explicit data-theft/exfiltration behavior visible. However, it has meaningful security risk due to (a) dynamic discovery and require() of Puppeteer from filesystem locations influenced by process.env.HYPERFRAMES_ROOT and broad directories (possible dependency-path poisoning/loader abuse), and (b) weakened browser security flags while executing a user-supplied local index.html, plus injecting a locally discovered JS payload (gsap.min.js) into the page via evaluateOnNewDocument. Use only with trusted projectDir and trustworthy dependency paths/checkout contents.

This code is primarily a local image/layout analysis CLI. It does not show direct malware behaviors (no networking, credential theft, or obvious persistence). However, it introduces a notable security risk: it dynamically resolves and requires 'sharp' from non-standard/writable filesystem locations (including HYPERFRAMES_ROOT and a user Downloads path), and it spawns a child Node process with an attacker-controlled project directory argument. If an attacker can influence those search roots/contents or the project directory processed by the child script, they could potentially achieve unintended code execution via the dependency or via measure-layout.cjs behavior. Otherwise, for trusted environments and inputs, the operational risk is low.

The code appears to be a browser-based animation renderer. The string-to-`eval` path in `renderSheet` is a significant code-injection risk if `at` can contain untrusted values. No direct evidence of data theft, external communication, or other malware appears in the provided fragment.

No clear malware, credential theft, network exfiltration, or obfuscation is present. There is a concrete destructive path-handling risk: an untrusted --quality value can influence the directory passed to shutil.rmtree and may cause deletion outside the intended render directory. Restrict quality values and verify the resolved deletion path remains beneath the expected renders directory.