docker-containerization
Warn
Audited by Socket on Sep 16, 2026
1 alert found:
SecuritySecurityscripts/docker-build.sh
MEDIUMSecurityMEDIUM
scripts/docker-build.sh
No direct evidence of embedded malware (e.g., exfiltration, backdoors, cryptomining) is present in this script. However, the script uses `eval` to execute a dynamically constructed `docker build` command that includes unsanitized, attacker-controlled CLI inputs—especially `--build-arg` and other flags—creating a serious command-injection risk on the build host/CI environment. In a supply-chain context, this can enable arbitrary command execution and potentially the production of malicious build artifacts, so the module should be refactored to avoid `eval` (e.g., construct a command array and execute it directly).
Confidence: 77%Severity: 82%
Audit Metadata