hile-monorepo
Warn
Audited by Socket on May 11, 2026
1 alert found:
AnomalyAnomalypackages/http/src/loader.ts
LOWAnomalyLOW
packages/http/src/loader.ts
This module implements a dynamic controller loader that uses glob-based filesystem discovery and runtime ESM dynamic imports to execute controller modules and register HTTP routes. No direct malware behaviors (e.g., exfiltration, backdoor networking, credential theft) are evident in the shown fragment. However, the `import(_file)` behavior is a high-impact sideloading vector: if an attacker can influence the `directory` or the contents of that directory, arbitrary code execution and malicious route injection become plausible. Truncation limits full verification of route sanitization and other potential behaviors.
Confidence: 60%Severity: 55%
Audit Metadata