consult-tavernweave-library

This fragment is a documentation/spec describing a thin-shell system that dynamically fetches and executes the main runtime from GitHub/jsDelivr into an iframe via Blob URL + injectBridge, with additional dynamic imports gated by readiness. No explicit malicious payload or exfiltration behavior is demonstrated in the text, but the design materially increases supply-chain attack surface by enabling remote code execution and cross-frame bridging; compromise or misconfiguration of URL/version selection could lead to arbitrary client-side script execution. Recommend strict integrity pinning (commit-hash/version pinning), cryptographic verification (signed manifests or SRI where applicable), and limiting/validating BASE/BASE_CF overrides, or disabling remote Git-loader-style behavior in high-trust contexts.