preview-svg

No strong indicators of covert malware behavior (e.g., persistence, exfiltration, backdoor logic, or system command execution) are present in this fragment. However, it deliberately writes untrusted CONTENT verbatim into an executable JavaScript file and then generates/opens an HTML page that can load and execute that JavaScript in a browser. Additionally, template substitution via envsubst relies on exported variables with only partial validation/escaping (notably superficial METADATA_JSON checking). Overall, the security risk is driven by high-impact client-side execution/injection risk when any upstream inputs (especially CONTENT and template-related variables) are not strictly trusted and sandboxed.

Main security finding: the module parses and injects base64-decoded SVG markup into the live DOM using DOMParser and appendChild with no sanitization or allowlisting of dangerous SVG constructs. This creates a significant SVG-based active content / DOM-XSS-style attack surface if the SVG source is not strictly trusted. No clear evidence of stealth malware behaviors (e.g., exfiltration or backdoors) exists in this fragment; the risk is primarily unsafe rendering of potentially untrusted SVG.