skills/dmccreary/ibook-skills/microsim-generator/Socket

microsim-generator

Warn

Audited by Socket on Sep 17, 2026

1 alert found:

Anomaly

Anomalyassets/templates/map/script.js

LOW

AnomalyLOW

assets/templates/map/script.js

No clear evidence of malware/backdoor behavior in this module. The main security concern is DOM-based XSS: untrusted strings from fetched data.json and remote GeoJSON are interpolated into HTML via this._div.innerHTML and Leaflet bindPopup templates without sanitization. Additionally, the remote GeoJSON is not integrity-pinned, increasing the chance of upstream tampering delivering malicious content.

Confidence: 78%Severity: 62%

Audit Metadata

Analyzed At

Sep 17, 2026, 11:06 AM

Package URL

pkg:socket/skills-sh/dmccreary%2Fibook-skills%2Fmicrosim-generator%2F@bbd9b26fad47828f6e30dd57b4e0133d47cd0ac6c57b9eb20a0a1a9523ca17c1