js-design-mcp

This module establishes an invisible UI context to perform an outbound XHR and then relays the fetched response back to the main widget to update state. There are no overt malware primitives shown (no exec/credentials), but the trust-boundary crossing, minimal input/response validation, hidden network capability, and wildcard postMessage target create a credible risk of covert tracking or data exfiltration depending on the actual endpoint and downstream rendering/usage. Validate and constrain the request destination(s), enforce strict message origin checks, avoid wildcard postMessage, and sanitize/limit what can be placed into widget state.