deepgram-common-errors

No clear malicious behavior or supply-chain backdoor is present. The principal security risk is command injection in splitAudio because execAsync receives a shell command containing unsanitized inputPath and chunkDuration. Use spawn or execFile with an argument array, validate that chunkDuration is numeric and bounded, and safely construct output paths. The code also sends audio and the API key to the expected Deepgram service and may load entire files into memory.