travel-guide

No strong evidence of intentional malware (no network/process execution/backdoor behavior visible). However, the module has a significant security risk: attacker-controlled image src values can cause arbitrary readable local files to be read and embedded as base64 data URIs inside the generated HTML output due to missing resolved-path containment checks. Additionally, source URLs are inserted into href attributes without an explicit scheme allowlist, which can pose client-side security risk depending on the rendered context. Overall, this is best treated as a high-impact data exposure vector rather than supply-chain malware.