nature-citation

No clear malware behavior is present. The utility performs expected bibliographic API requests and generates citation files. The optional HTML artifact has a security issue: untrusted metadata can be interpreted as markup through innerHTML, and the JSON-in-script escaping is incomplete. Treat generated HTML as unsafe when processing untrusted metadata; escape values or construct DOM nodes with textContent and safely encode embedded JSON.