accessibility

Warn

Audited by Socket on Oct 8, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/runtime_a11y/runner/index.mjs

This file is a dynamic local probe/module loader. It is not overtly malicious on its own, but it can execute arbitrary code from a dynamically imported .mjs module determined by an untrusted CLI argument. Because probeId is not allowlisted or constrained to remain within the intended directory, the primary risk is unintended module loading/execution (including potential path traversal) if an attacker can influence probeId and/or available modules/files.

Confidence: 66%Severity: 60%
Audit Metadata
Analyzed At
Oct 8, 2026, 11:00 AM
Package URL
pkg:socket/skills-sh/microsoft%2Fhve-core%2Faccessibility%2F@dc5b3b76c3f8eb2c6cdbc9a9e8e77545643b31ecd689fe84d8f62f3c89e69d43