release-flutter-web-s3
Warn
Audited by Socket on Aug 9, 2026
1 alert found:
AnomalyAnomalyscripts/release_web_s3.py
LOWAnomalyLOW
scripts/release_web_s3.py
No clear evidence of hidden malware, exfiltration, or backdoor behavior in the provided module. However, the script supports arbitrary command execution by running configurable strings through `bash -lc` (PRE_BUILD_CMD/BUILD_RUNNER_CMD/SLANG_CMD/TEST_CMD sourced from deploy/*.env and environment). This creates a strong sabotage/execution risk if an attacker can influence those config values or CI environment variables. The tool also performs S3 sync with `--delete`, which can cause destructive publishing if configuration is wrong or attacker-controlled.
Confidence: 74%Severity: 68%
Audit Metadata