hyperframes-media-use

No clear evidence of intentional malware or data theft is present in this snippet. The main security concerns are (1) supply-chain exposure from using npx to run 'hyperframes' without visible version pinning/integrity controls, and (2) filesystem overwrite/path traversal risk because wavAbs (and related paths) are used for directory creation and file writes and as ffmpeg output. Command execution is done via argv arrays (reducing classic shell injection), but the overall impact remains high due to running external processes with caller-influenced parameters.

The code path local-run.mjs invokes commands using execFileSync with shell enabled and constructs the command by interpolating user-controlled variables into the model invocation template, allowing arbitrary OS command execution if attackers can influence opts.vars or the model invocation templates upstream. To mitigate, avoid shell: true and use safe argument-based execution with strict validation and escaping of any template variables.

This module is primarily a download-and-store utility with a 256MB size cap. It is not overtly malicious (no backdoor/persistence/stealth behavior evident), but it is security-sensitive: freezeUrl performs unrestricted http(s) fetches of caller-provided URLs (SSRF risk if untrusted input reaches it) and writes downloaded bytes directly to caller-provided paths (arbitrary file write risk). freezeLocalFile additionally enables arbitrary file copy if paths are not controlled. The URL safety helper exists but is not enforced inside freezeUrl, so mitigation depends on external caller logic.