moda-video-demo

The postinstall script automatically runs Playwright's installer to download and install Chromium browser artifacts. This is not obviously a direct malware payload (no reverse-shell, no explicit exfiltration, no obvious system-destroying rm commands), but it has notable supply-chain and runtime risks: npx invokes package code which executes during install; Playwright's installer downloads large native/browser artifacts and may make network requests; optional SDKs and native binaries increase the attack surface. You should review the package's shipped scripts (e.g., run.mjs, doctor.mjs, any postinstall hooks in dependencies), and be aware that running npx (even for a declared dependency) executes code during install and can be abused if an upstream package is compromised.