xhs-search-workflow

Warn

Audited by Socket on Sep 24, 2026

1 alert found:

Security
SecurityMEDIUM
assets/js/xhs_xs_xsc_56.js

This fragment contains an intentionally obfuscated bytecode payload executed by a custom virtual machine and includes sensitive browser-session data. The visible code does not establish that the payload exfiltrates data or is malware, but the opaque executable content and credentials warrant review of the decoded bytecode and the larger file before use.

Confidence: 98%Severity: 72%
Audit Metadata
Analyzed At
Sep 24, 2026, 06:33 AM
Package URL
pkg:socket/skills-sh/chinatsu1124%2Fxhs-search-workflow-skill%2Fxhs-search-workflow%2F@8d57dd8834b51f6dc6b8acec12d31a06802b4bdcae8ff63dd202ae5e2e29b0b3