lovstudio-any2pdf

This module does not exhibit clear malware/backdoor behaviors (no eval/exec/subprocess/persistence/credential harvesting). However, it meaningfully increases attack surface for supply-chain/operational abuse: it performs outbound HTTP(S) requests for arbitrary user-supplied image URLs referenced in Markdown, caches downloaded binaries to predictable temp directories, and it can include local files via file:// and resolved local paths without explicit containment enforcement. In untrusted/automated contexts, treat it as a potentially unsafe renderer and restrict image source schemes/domains and constrain/normalize local paths to prevent SSRF/LFI-style abuse and resource exhaustion.