magnet-path
Warn
Audited by Socket on Sep 4, 2026
1 alert found:
AnomalyAnomalyscripts/magnet_path.py
LOWAnomalyLOW
scripts/magnet_path.py
This module is best characterized as an authenticated data-visualization client that reads a plaintext bearer token from a local .env_agent_api file and sends it to a hardcoded remote API to fetch JSON chart data, then saves a Matplotlib-generated PNG to a user-supplied path. No clear execution/backdoor behavior is present in the fragment, but the supply-chain risk is elevated due to implicit local secret discovery and transmission of that secret to a fixed external destination, plus unvalidated file output path handling (possible overwrite).
Confidence: 72%Severity: 60%
Audit Metadata