graphic-ebook

The code appears to be a legitimate HTML-to-PDF export utility and contains no clear malware, credential theft, persistence, or intentional data exfiltration. It has a meaningful path traversal risk in the temporary static server because decoded URL paths are passed to readFileSync without containment validation. It also executes untrusted presentation JavaScript and installs runtime dependencies, so it should only process trusted input and should bind explicitly to 127.0.0.1. Fix the server by resolving and validating canonical paths under SERVE_DIR, rejecting traversal and non-file requests, and explicitly binding to localhost.