feishu-evolver-wrapper
Warn
Audited by Socket on Mar 28, 2026
1 alert found:
SecuritySecurityindex.js
MEDIUMSecurityMEDIUM
index.js
This wrapper contains a high-risk supply-chain/orchestration pattern: it extracts a payload from untrusted child stdout and, on JSON parse failure, uses new Function(...) to evaluate that payload—creating an untrusted-data-to-code-execution path. It also forwards child stdout/stderr and status information to external reporting functions and passes extracted task content to another agent via CLI arguments, amplifying the impact of any malicious payload. No explicit cryptomining/backdoor is visible here, but the dynamic execution primitive makes the module meaningfully dangerous if any upstream stage is compromised.
Confidence: 72%Severity: 78%
Audit Metadata