minimax-pdf

This module is a PDF rendering utility with significant security-relevant behaviors: it can execute code from newly installed dependencies at runtime via unpinned pip installation (with '--break-system-packages'), and it allows untrusted JSON to reference arbitrary local font and image file paths that may be embedded into the generated PDF. The math/chart/flowchart rendering pipeline further increases the risk of denial-of-service through compute-intensive rendering driven by attacker-controlled data. No clear evidence of overt malware (exfiltration/backdoor/reverse shell) is present in the snippet, but supply-chain and local file inclusion/confidentiality risks are meaningful.