impeccable

No definitive malware indicators (no credential theft, backdoor, persistence, or direct eval/exec of attacker-controlled code) are visible in this module. The security risk is primarily due to capability breadth: it can fetch and inline remote resources referenced by attacker-influenced DOM/CSS and can load caller-supplied Web Workers (workerUrl execution boundary). If the consuming application processes untrusted DOM/CSS or untrusted options, the module may cause unintended outbound requests and increase rendering/injection attack surface in the generated SVG/stylesheet context.

This module’s apparent purpose is benign (local event polling and forwarding), but it contains a serious execution-risk design: it uses execSync with a shell-interpreted command string constructed from server-delivered event fields (notably paramValues, and also id/variantId). If an attacker can influence the local “live” server response or the local .impeccable-live.json, this can enable command injection or arbitrary argument manipulation when running the helper script. Additionally, the token is placed in a URL query string for long-poll requests, which can leak into local logs/history/tooling despite targeting localhost.