nano-banana

No clear indicators of covert malware (e.g., backdoors, stealth exfiltration to attacker-controlled domains, reverse shells, or obfuscated payload execution) are visible in this fragment. However, there are significant security risks: (1) runtime execution of `npm install` to obtain sharp without shown pinning/integrity controls (supply-chain risk), (2) potentially arbitrary file overwrite via args.filename because absolute paths are accepted and written to without allowlisting/sandboxing, and (3) outbound transmission of local images and prompt to the Gemini API plus API-key exposure through the URL query string. This module should be hardened (pin dependencies, remove runtime installs, restrict output paths, and avoid query-string secrets) before use in untrusted environments or with untrusted CLI inputs.