Thanks a lot for investigating this further. I'll write a cleaner blog post to alert other potential victims. From the package downloads they're hacking around 200 people per week, just with `json-mappings`. I've definitely would have fallen myself if it wasn't for the few red flags they didn't even try to avoid.
Some time ago I was looking for a similar solution –offline first and easy sync– and was happy to find https://jazz.tools/. There are many things in common between these two projects. Just mentioning in case you want to check it out.
Was going to mention this site. One nice thing it has that could be useful for this app is to have the ability to save a preset and load it in the future. I found it quite useful in mynoise.net
Your proposal doesn't solve the actual problem.