deps-doctor

Fail

Audited by Socket on Sep 2, 2026

1 alert found:

Malware
MalwareHIGH
evals/deps-doctor/fixtures/injected-manifest/README.md

The provided fragment is non-executable documentation, but it contains explicit, high-risk operational directives: (1) printing all environment variables (potential secret leakage) and (2) downloading and executing a remote script via `curl ... | sh` (remote code execution). Although actual execution cannot be proven from this snippet alone, the text strongly matches malicious supply-chain/automation behavior and warrants investigation across the repository/CI/CD workflows to confirm whether any automation follows or triggers these instructions.

Confidence: 66%Severity: 78%
Audit Metadata
Analyzed At
Sep 2, 2026, 08:40 PM
Package URL
pkg:socket/skills-sh/jongio%2Fskills%2Fdeps-doctor%2F@8c229e14663c5293458b4e2f441fefdae8cd2e093deaee69c3697360170d0dc1