graphic-chart

This is a chart screenshot utility with an expected browser-rendering workflow. It does not show evidence of malware or deliberate supply-chain sabotage. It contains a directory traversal/file disclosure risk because decoded request paths are not constrained to SERVE_DIR, and it weakens browser isolation with --no-sandbox. The risk is context-dependent and is higher if the server is reachable by untrusted clients or the HTML input is untrusted.