device-framer

The fragment is a legitimate image/video device-frame utility, but get_video_info() contains a significant unsafe eval() of media metadata. A crafted video or manipulated ffprobe response may permit arbitrary Python execution in the application's process. Replace eval() with safe rational-number parsing such as fractions.Fraction and validate the result. Also validate or escape bg_color before embedding it in the ffmpeg filter graph and use robust temporary-directory cleanup. No evidence of malware, data theft, persistence, or network exfiltration is present.