syncfusion-javascript-popups

The fragment appears to be legitimate UI component documentation or sample code, not malware. It contains a clear DOM XSS security issue because user input is written to innerHTML without sanitization; textContent or a trusted sanitizer should be used instead. No evidence of supply-chain malware, data theft, persistence, or other malicious behavior is present in the shown code.