ore-miner

Fail

Audited by Socket on Jun 19, 2026

3 alerts found:

SecurityMalwareAnomaly
SecurityMEDIUM
SKILL.md
MalwareHIGH
scripts/deploy.sh

This module is a purpose-built mining launcher that authenticates with a provided API key, fetches the associated wallet address, and starts automated mining on a remote service with custom tile IDs and auto-restart enabled. While it lacks obfuscation and does not perform typical malware behaviors like reverse shells or local data theft, its explicit cryptomining side effect and persistent configuration make it high-risk and likely malicious/abusive if executed without clear user authorization and a trusted API endpoint.

Confidence: 78%Severity: 85%
AnomalyLOW
scripts/mine.sh

This module is a networked automation client that starts an auto-restarting mining session via a remote API using a user-provided API key. It does not show classic malware traits (no persistence, shell control, or host data theft) in the provided code. The primary risks are operational/abuse: it will continuously/recurringly request mining activity (auto_restart + every_round) and it will send the API key to an arbitrary, user-supplied API_URL without domain/protocol validation, while also logging wallet address and response bodies.

Confidence: 64%Severity: 56%
Audit Metadata
Analyzed At
Jun 19, 2026, 08:20 AM
Package URL
pkg:socket/skills-sh/JussCubs%2Fore-miner-skills%2Fore-miner%2F@e2e4c2edd9519d555c8d1f551b3a43317e1e142d6ab06d99e5b979b46acb3079
Security Audit — socket — ore-miner