service-omni-command-center-analyze
Warn
Audited by Socket on Sep 18, 2026
1 alert found:
AnomalyAnomalyscripts/tests/_bootstrap.py
LOWAnomalyLOW
scripts/tests/_bootstrap.py
This code is a dynamic command orchestrator that executes a project-provided bash script while allowing substantial caller influence over the runtime environment (notably PATH) and optionally overrides a dependency tool by creating a fake executable named `sf`. No direct malicious behavior (exfiltration, backdoor, persistence) is shown in the fragment, but the combination of (1) executing an external shell script and (2) injecting/overriding an executable via PATH resolution creates meaningful supply-chain/security risk. The assessment is limited by the incomplete `_FAKE_SF` definition and missing integration context for how `FakeSf` affects `PATH` during `run()` execution.
Confidence: 42%Severity: 62%
Audit Metadata