browser-cdp

This module is not a classic stealth malware/backdoor based on the provided fragment (no eval/dynamic payload execution, no external exfiltration). However, it performs high-impact browser automation: it copies sensitive Chrome authentication/session files into a debug profile and launches Chrome with CDP enabled and broad origin allowance (--remote-allow-origins=*). That combination meaningfully increases the risk profile for anyone who runs the package (or if the package were altered) because it can facilitate session hijacking or further automated access to authenticated browser state, especially in the presence of local attackers or misconfigured access to the CDP port.