github-pages-publisher
Warn
Audited by Socket on Sep 14, 2026
1 alert found:
AnomalyAnomalyscripts/publish_static.py
LOWAnomalyLOW
scripts/publish_static.py
The code appears to be a deployment/publishing utility rather than malware. It intentionally clones, modifies, commits, and pushes to a GitHub repository using an environment-provided token. The primary security risk is exposure of GHPAGES_TOKEN through the git URL and process or diagnostic metadata. Source contents are published to the configured repository, so misuse of the source path or credentials could cause unauthorized content publication. No clear data theft, persistence, destructive system activity outside the temporary repository, or obfuscated malicious payload is present. The supplied code is syntactically incomplete because it ends with `main(`.
Confidence: 98%Severity: 58%
Audit Metadata