distill-page

No clear malicious or supply-chain backdoor behavior is present. The code implements a page-distillation utility and uses safe text-based DOM insertion. However, arbitrary URL navigation, support for file URLs, normal execution of remote page scripts, and disabled Chromium sandboxing create meaningful SSRF/local-resource and browser-isolation risks when URLs are attacker-controlled or the utility runs in a privileged environment. The risk is contextual and should be mitigated with URL allowlisting, network isolation, and sandboxing.