visual-explainer

No clear evidence of covert malware (no exfiltration, no persistence, no obfuscation, no dynamic code execution from inputs via eval). However, the module has high-impact functionality: it detects an owning package.json and executes its publish/export/build script via spawn during rebuild. If an attacker can influence or swap the target HTML’s owning project/package.json, this becomes a command-execution vector. Given localhost-only server and strong mutation guards, exposure is limited, but the design choice to execute package scripts is the primary supply-chain/sandboxing risk to review.