llmer-demo

This is a demo-recording studio server, not evident malware: it performs no credential theft, destructive actions, or suspicious network exfiltration. Its primary security concerns are unauthenticated access to recording, file-serving, and render endpoints, unbounded POST-body/render resource use, and stored XSS from recording names inserted via innerHTML; preview HTML safety depends partly on the unprovided generateFrameHtml implementation. The server does not explicitly bind to loopback, so its exposure may extend beyond the local machine. Severity: medium when reachable by untrusted clients; Google font requests go to fonts.googleapis.com and fonts.gstatic.com.

This module implements video-processing utilities and local browser interaction overlays. The principal security concern is command injection: caller-controlled file paths are interpolated into shell commands passed to execSync, and caller-controlled parameters also enter ffmpeg filter expressions. The keystroke overlay displays input locally and does not exfiltrate it in this code. Severity is dependent on whether untrusted callers can supply these arguments; use child_process.execFile with argument arrays and validate filter values.

This module renders video with zoom and annotations. It has a security risk because inputPath is interpolated into shell commands executed by execSync, allowing command injection if an attacker can control the path; generated annotation code is also executed with eval, with exploitability dependent on the unseen generator. No network exfiltration, credential theft, or other malware behavior is evident in this fragment. Severity is moderate to high when these values are attacker-controlled.

This code generates a browser terminal connected to a localhost WebSocket and includes a visible keystroke overlay and a global terminal-buffer accessor. No clear malware, credential harvesting, or external exfiltration behavior is evident; however, unvalidated options are embedded into HTML, CSS, and JavaScript, creating injection risk if callers can supply untrusted values. Severity is moderate and depends on whether these options are attacker-controlled; third-party scripts are loaded from unpkg.com.