dev-lgnh

This is a local authenticated HTTP/WebSocket companion server, with no clear evidence of malware or unauthorized data exfiltration. The principal security concerns are unsanitized served HTML, which can execute same-origin scripts, and shell execution through cp.exec() when BRAINSTORM_OPEN_CMD is configured; the token also appears in the companion URL and server-info log. The service defaults to 127.0.0.1 and uses token authentication, but malicious or untrusted screen content and unsafe command configuration could compromise the local browser or host. Severity: medium, conditional on untrusted screen files or command configuration; the branding references primeradiant[.]com and github[.]com.