nocobase-ui-builder

The fragment documents a legitimate dynamic dependency-loading feature and contains no direct evidence of malware. Its main security concern is architectural: arbitrary external ESM and CSS resources are trusted and executed or injected at runtime, with the default source being esm.sh. Production deployments should restrict permitted origins, pin and verify dependencies where possible, use a trusted/self-hosted CDN, and treat loaded modules as fully privileged application code. The frappe-gantt HTML interpolation should also be escaped or restricted when task data is untrusted.