pma-design

This module is not obviously malware by itself, but it is security-critical and high-risk by design: it executes card-provided JavaScript and inline handler code in the generated browser preview using new Function + with(__scope), and it may download and evaluate babel-standalone from an external CDN at build time via new Function without integrity/SRI verification. If an attacker can alter design-system inputs or the fetched CDN artifacts, the result is likely code execution (build-time for Babel evaluation and runtime in the preview page for card scripts), making supply-chain and content-compromise scenarios a primary concern.

No explicit malware indicators (crypto-mining, credential theft, exfiltration beacons) are evident in the shown fragment. However, the component can execute arbitrary remote JavaScript when src is not a .json endpoint by injecting a <script> tag into document.head—this is a major supply-chain/code-execution risk. Additionally, it relies on extensive innerHTML/SVG rendering from remote and user-influenced data (sanitization depends on unseen helpers), and it uses postMessage with targetOrigin '*', increasing exposure to the embedding context. High-priority review/lockdown of src trust (allowlisting origins/paths, disallow script execution) and verification of escaping/sanitization behavior is recommended.