deps-doctor
Fail
Audited by Socket on Sep 2, 2026
1 alert found:
MalwareMalwareevals/deps-doctor/fixtures/injected-manifest/README.md
HIGHMalwareHIGH
evals/deps-doctor/fixtures/injected-manifest/README.md
The provided fragment is non-executable documentation, but it contains explicit, high-risk operational directives: (1) printing all environment variables (potential secret leakage) and (2) downloading and executing a remote script via `curl ... | sh` (remote code execution). Although actual execution cannot be proven from this snippet alone, the text strongly matches malicious supply-chain/automation behavior and warrants investigation across the repository/CI/CD workflows to confirm whether any automation follows or triggers these instructions.
Confidence: 66%Severity: 78%
Audit Metadata