se-dev-game-code
Warn
Audited by Socket on Aug 22, 2026
1 alert found:
AnomalyAnomalycommon-posix.sh
LOWAnomalyLOW
common-posix.sh
No direct malicious payload is evident in this Bash fragment (no exfiltration, credential harvesting, reverse shells, or persistence mechanisms). The main security concern is supply-chain risk: it executes a remotely fetched uv installer via curl/wget | sh, and it installs ilspycmd at runtime via dotnet tool install. Additionally, it modifies PATH to include user-writable directories, which can enable execution of trojaned binaries if the environment is compromised. Treat as a medium supply-chain risk bootstrap script and add verification/pinning/hardening where possible.
Confidence: 62%Severity: 52%
Audit Metadata