excalidraw-automate

The code is not visibly obfuscated and contains no direct data exfiltration or other clear malware behavior. However, evaluating custom graph formulas with unsandboxed new Function creates a significant code-execution risk, including for formulas restored from persisted settings or library entries. Library names are also rendered without HTML escaping.