novu-inbox-integration

The fragment is benign usage documentation with no evidence of malware or supply-chain sabotage. The vanilla rendering example has a meaningful XSS risk because remotely supplied notification subject and body values are inserted via innerHTML without escaping or sanitization. Use textContent, DOM construction, or a trusted HTML sanitizer for notification content. The displayed filters example also requires a missing comma fix.