markdown-mdx-content-pipeline-weapon

High-risk construction: the client component evaluates Velite-compiled MDX output via `new Function`, creating an `eval`-like sink from MDX content (`content/posts/*.mdx`) to browser execution. Even if the system intends trusted author content, this is a serious security hazard under threat models involving untrusted/compromised MDX or compromised build tooling; it materially increases the likelihood of client-side compromise and data exposure. No clear explicit malware payload (e.g., network exfiltration) is present in the snippet, but the execution primitive itself is the dominant risk.