3d-model-generator-by-threejs

This file is an orchestration/CLI wrapper for model generation and export. It does not contain obvious in-module malware (no network calls, no subprocess execution, no eval/Function usage, no credential/secret handling, no hidden payloads). The main security risk is supply-chain/code-execution by design: it loads and executes a user-specified build module via loadModelBuild(options.build) and then runs loaded.buildModel(context). If --build is attacker-controlled or not strictly sandboxed/allowlisted, an attacker can run arbitrary code. Separately, the module writes to a user-controlled output directory (--out) and records build module paths and generated metadata into JSON outputs, which may increase unintended information disclosure.