context-drop

Fail

Audited by Socket on Sep 3, 2026

1 alert found:

Malware
MalwareHIGH
scripts/drop.py

This module is a local-file collection and remote-upload client. It recursively reads arbitrary local files from operator-supplied paths, encodes contents (text or base64), and exfiltrates them via authenticated HTTP POST to a configurable remote API to generate shareable URLs with deletion control. The presence of environment-configured destination/authentication and heuristic-only secret avoidance make it high-risk for supply-chain scenarios where it could be invoked to transmit sensitive data.

Confidence: 80%Severity: 92%
Audit Metadata
Analyzed At
Sep 3, 2026, 03:44 AM
Package URL
pkg:socket/skills-sh/ara-labs%2Fagent-native-research-artifact%2Fcontext-drop%2F@7962947a4f42b982c5645cc11c43e009ecfd69f74b0325defebb63de5e22172a