re0-squash
Warn
Audited by Socket on Nov 9, 2026
1 alert found:
AnomalyAnomalyscripts/squash.mjs
LOWAnomalyLOW
scripts/squash.mjs
This is a readable GitHub repository maintenance CLI, not apparent malware. Its republish command deliberately deletes and recreates the specified GitHub repository, then pushes local history and restores only selected settings; secrets, variables, webhooks, rulesets, deploy keys, and collaborators are not restored. Deletion requires an exact `--confirm` value and detected blockers require `--accept-loss`, but data loss remains a high-impact operational risk. No suspicious domains, hardcoded credentials, or covert data flows are evident.
Confidence: 98%Severity: 68%
Audit Metadata