rails-active-storage

No evidence of intentional malware or supply-chain sabotage is present. The principal security issue is a DOM XSS vulnerability in the example that assigns the user-controlled file.name to innerHTML; use textContent or DOM construction instead. Disabling CSRF protection on the custom direct-upload endpoint is also a security concern and requires careful compensating controls. Server-side authorization and validation remain necessary.