html-artifact

No clear malware, data exfiltration, or unauthorized system activity is present. The primary security issue is DOM XSS through crafted CSV column names in inline event-handler attributes. CSV exports may also trigger formulas in spreadsheet applications.