wjs-burning-subtitles

The code is a media-processing utility, not clear malware. It does not read credentials, exfiltrate data, spawn a shell, or establish persistence. The principal supply-chain and security concerns are automatic execution of an unauthenticated downloaded binary, unsafe ZIP extraction, predictable /tmp paths, and insufficient escaping of user-controlled values in the ffmpeg filter expression. These issues warrant remediation, but the fragment provides no strong evidence of malicious intent.