clipchamp-video

This file is an automation utility that performs browser UI interactions (login/loading stabilization and popup dismissal) and writes local logs of runtime/browser metrics. The dominant supply-chain security concern is the host execution sink: it runs a local maximize.ps1 via PowerShell with '-ExecutionPolicy Bypass'. While the snippet itself shows no explicit exfiltration or credential theft, the execution-policy-bypassed PowerShell launcher materially increases the impact of any compromise or tampering of the shipped maximize.ps1 script or package content. Without inspecting maximize.ps1 and the calling code that wires log(), the malware intent cannot be confirmed, but the security risk remains moderate-to-high due to host-side code execution.

This module is a high-risk launcher that records the Windows desktop to a local MP4 using `ffmpeg` (gdigrab) and then executes bundled helper scripts (`arrange.ps1` via PowerShell with `-ExecutionPolicy Bypass`, and `recorder.js` via Node with inherited stdio and environment access). The behavior is strongly consistent with spyware/surveillance tooling, though definitive malware intent (e.g., exfiltration or persistence) cannot be confirmed without the contents of the executed helper scripts. Treat this package as suspicious and review/contain it before use.

This module performs high-risk browser profile cloning: it force-stops Edge, copies Local State and Profile 1 (likely including cookies/session artifacts), patches the cloned Preferences to keep the profile usable, and verifies cookie presence. Even without explicit exfiltration shown here, the behavior is consistent with enabling session hijacking/account compromise if the copied profile is reused improperly. Requires strict user consent, isolation, and strong governance around handling and disposal of the cloned profile artifacts.