html-prototype-build

The code is a legitimate pack installer and contains no clear malware indicators. Its main security issue is unsafe path handling: remote tar entry names and local manifest IDs are not constrained to remain within the intended destination, creating a potential path traversal/write or destructive deletion vulnerability when installing malicious archives or local packs. Remote sources are configurable and unsigned, so users should trust and validate registry and repository sources. The risk is primarily conditional on using an untrusted registry, tarball, or local pack.

The code implements an HTML inspector and IDE launcher. It does not show evidence of malware or deliberate data exfiltration. Security concerns are concentrated in the Windows ComSpec command construction, which can allow command injection if CODE_EDITOR or filePath is attacker-controlled, and in symlink-based escapes from the configured root. Use canonical real paths for containment and avoid shell execution; invoke the executable directly or use robust Windows argument escaping.