global-report

The code is primarily a report and asset utility module, but its exported which(command) function can execute shell expansions from an untrusted command string because it interpolates that string into /bin/sh -c; this is a command-injection risk requiring caller control of the argument. PDF paths are passed as arguments to utilities, and resolveInside() provides lexical containment but does not account for symlinks. No network exfiltration, credential theft, or other clear malware behavior is shown; overall severity is moderate and depends on whether untrusted callers can reach which().

This is a document-preview CLI with no evident malware, credential theft, or network exfiltration. The primary security risk is destructive: a supplied --out-dir is recursively deleted before rendering, so an invocation with an unintended existing path can erase its contents. Validate or constrain the output directory before deletion; severity is moderate, and the DPI option should also be bounded.