space-video-broll

No direct indicators of classic malware behavior (e.g., credential theft, reverse shells, or explicit network exfiltration) are present in this module’s logic. However, the module is security-sensitive: it executes untrusted local HTML/JS in a headless Chromium instance launched with "--no-sandbox" and it executes external binaries chosen from potentially attacker-influenced locations (Chromium via CHROME_PATH/cache discovery; ffmpeg via PATH). If htmlArg and/or the runtime environment are not trusted, the risk level increases substantially. Otherwise, in a controlled rendering pipeline with trusted inputs and pinned binaries, it is likely intended as a benign HTML-to-video renderer.