zsxq

No strong indicators of overt malware (no credential access, persistence, or explicit data exfiltration). However, the module has meaningful security risks under an untrusted-input threat model: it disables Chromium sandboxing while executing caller-supplied local HTML, and it runs ffmpeg via execSync using a command string that incorporates user-controlled outputFile (a potential shell command injection surface). Treat inputs (htmlFile/outputFile) as untrusted and mitigate by enabling sandboxing and using spawn/execFile with argv arrays plus strict path validation.