pm-preview

Warn

Audited by Socket on Sep 25, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/stop-preview.sh

The script has potentially destructive path-validation and process-targeting risks. In particular, the /tmp prefix check can permit deletion outside /tmp via path traversal, and an untrusted PID file can cause signals to be sent to unintended processes. The fragment does not provide evidence of malicious intent.

Confidence: 98%Severity: 72%
Audit Metadata
Analyzed At
Sep 25, 2026, 01:17 PM
Package URL
pkg:socket/skills-sh/konglong87%2Fsuperpm%2Fpm-preview%2F@8ff1e699070dcb72eacb5c22576d649a80c8969d6ab2b98c4096b248ae9b1835