e2e-macos

Warn

Audited by Socket on Oct 2, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/macos-target.py

The code appears to be a purpose-built macOS E2E bootstrap and validation runner, not overt malware. Its high-impact behavior is intentional for its stated role: it executes a cloned repository's installer and request-supplied helper scripts, writes a supplied credential temporarily, and permits those scripts to modify user-level services and Docker state. Trust in the repository, commit source, request producer, and installer scripts is therefore required. The provided fragment contains no clear malicious payload or direct data exfiltration, but it represents a significant code-execution supply-chain boundary.

Confidence: 96%Severity: 62%
Audit Metadata
Analyzed At
Oct 2, 2026, 09:44 PM
Package URL
pkg:socket/skills-sh/nanocoai%2Fnanoclaw-oss-dev-tools%2Fe2e-macos%2F@69957a3b02eab739cf427a270fbdcc47bbef0a69e7854b0d29da884f1efd69f0