url-to-motion-design

This is a browser scene-rendering worker that executes documents supplied by /next and uploads generated frames to same-origin endpoints. The combination of allow-scripts and allow-same-origin means job content can access the parent page and its same-origin capabilities, so untrusted jobs could compromise the runner or perform unauthorized same-origin requests. This is a significant isolation risk if /next can return attacker-controlled jobs; the fragment alone does not establish malicious intent or a specific external exfiltration destination.

This is a loopback scene-rendering server, not evident malware; it accepts unauthenticated requests that can select files to read and output directories for creation and frame writes, and forwards render documents to connected runners. It binds to 127[.]0[.]0[.]1 and uses wildcard CORS for JSON responses. Severity is moderate because a reachable local client may abuse filesystem access; no external domains, credentials, or obfuscated payloads are present.

This CLI builds a local HTML screening page and does not show explicit data exfiltration or destructive behavior. It has meaningful injection risks if its inputs are untrusted: scene HTML runs in unsandboxed same-origin srcdoc frames, and --title and --canvas are inserted into HTML without context-appropriate escaping. The dynamic import selected by FIL_REPO also executes code from that repository path. Treat as a security warning for untrusted input; no suspicious external domain, IP, or credential target appears in this fragment.