zoom-apps-sdk

The code appears to be a legitimate Zoom OAuth sample and contains no clear malware or supply-chain backdoor. It has a significant DOM-XSS risk from inserting Zoom-derived values into innerHTML without escaping, and it stores OAuth tokens in a client-side signed but unencrypted cookie-session. Replace innerHTML interpolation with textContent or proper escaping, and store tokens server-side or in an appropriately protected encrypted session. Use a strong SESSION_SECRET and review the external SDK trust model.