hyperframes-embedded-captions

This module is a local rendering/measurement harness with no explicit data-theft/exfiltration behavior visible. However, it has meaningful security risk due to (a) dynamic discovery and require() of Puppeteer from filesystem locations influenced by process.env.HYPERFRAMES_ROOT and broad directories (possible dependency-path poisoning/loader abuse), and (b) weakened browser security flags while executing a user-supplied local index.html, plus injecting a locally discovered JS payload (gsap.min.js) into the page via evaluateOnNewDocument. Use only with trusted projectDir and trustworthy dependency paths/checkout contents.

This code is primarily a local image/layout analysis CLI. It does not show direct malware behaviors (no networking, credential theft, or obvious persistence). However, it introduces a notable security risk: it dynamically resolves and requires 'sharp' from non-standard/writable filesystem locations (including HYPERFRAMES_ROOT and a user Downloads path), and it spawns a child Node process with an attacker-controlled project directory argument. If an attacker can influence those search roots/contents or the project directory processed by the child script, they could potentially achieve unintended code execution via the dependency or via measure-layout.cjs behavior. Otherwise, for trusted environments and inputs, the operational risk is low.