linkfox-amazon-ads-manager
Audited by Socket on Aug 18, 2026
7 alerts found:
Anomalyx7The provided code is a thin wrapper that changes import precedence (sys.path.insert) and delegates all security-relevant work to a local helper (_sb_common.run_mutation). No explicit malicious behavior is visible in this fragment (no direct exfiltration, shelling out, or credential theft), but the combination of runtime import-path manipulation and unknown helper implementation makes the overall security assessment uncertain. The primary actionable check is to verify that the imported _sb_common module is the expected one and that run_mutation does not perform unsafe network exfiltration, persistence, or arbitrary execution with the provided payload.
This module is a thin launcher that dynamically executes the packaged file v4/create_budget_rules.py using runpy.run_path with __main__ semantics. The wrapper contains no explicit malicious behavior by itself, but it introduces a high-impact sink (dynamic code execution) whose behavior is entirely determined by the unseen target script. Review v4/create_budget_rules.py for malicious actions (e.g., credential access, data exfiltration, persistence, or unexpected network/subprocess/file operations).
This module is a minimal delegating launcher that dynamically executes a bundled local script (v4/update_campaigns.py) via runpy.run_path. The provided fragment contains no explicit malicious logic, but it is a significant execution sink without integrity checks; the actual security posture depends entirely on the contents and provenance of v4/update_campaigns.py. Review that target script for network access, credential handling, persistence, and data exfiltration before assessing the package as safe.
This fragment is a minimal dynamic launcher/entry-point that executes v4/update_ad_groups.py as __main__. The wrapper itself shows no overt malicious logic, but its use of runpy.run_path creates a strong dependency on the (missing) target script’s behavior. Review/audit v4/update_ad_groups.py and its dependency chain to determine whether the delegated actions are safe.
This module is a minimal bootstrapper that dynamically executes a bundled local script (v4/list_ad_groups.py) using runpy.run_path as __main__. The fragment itself shows no explicit malicious behavior, but the dynamic execution indirection means the real risk depends entirely on the contents of the delegated script, which is not provided. Treat as medium risk until v4/list_ad_groups.py is reviewed for credential theft, data exfiltration, command execution, or persistence.
This file is a minimal launcher that executes a bundled script (v4/update_ads.py) via runpy.run_path as __main__. The wrapper itself shows no overt malicious behavior, but it creates a strong indirection point where all security-relevant actions would occur in the unseen target script. Review v4/update_ads.py to confirm whether it performs benign update behavior or introduces malicious capabilities (e.g., data collection/exfiltration, persistence, or command execution).
This fragment is a thin and deterministic launcher that resolves a bundled script and executes it via runpy.run_path as __main__. While the wrapper itself shows no malicious behavior, it introduces a high-impact dynamic code execution sink; the overall malware/security risk cannot be determined without inspecting v4/create_ads.py. Based on the visible code alone, risk is moderate due to delegation to an unreviewed payload, not due to explicit malicious logic in this snippet.