charles-arcade-motion

This is a browser UI/mockup and animation library with no evident malware, network exfiltration, credential theft, or destructive behavior. It has a security concern: untrusted API arguments can flow into unescaped HTML/SVG strings and DOM insertion points, creating potential XSS, especially through AR.wbLanding and AR.questMap. Severity is moderate and depends on whether callers supply attacker-controlled values; no domains, URLs, IPs, or credential targets are present.

This is a browser character-rendering and animation library with no evident malware, credential theft, or unauthorized data transmission. A DOM injection/XSS risk exists because caller-controlled sign colors are interpolated into SVG markup assigned through innerHTML in signFace; custom prop and sign image URLs also cause browser resource loads. Severity is moderate and depends on whether untrusted input can reach C.signs color options.