hyperframes-media

Warn

Audited by Socket on Nov 8, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/lib/bgm.mjs

The code appears to implement legitimate background-music retrieval and generation rather than malware. No direct secret exfiltration or destructive behavior is present. Security concerns are concentrated in unpinned runtime pip installation, execution of a caller-provided Python recipe, external model downloads, and insufficient validation of filesystem paths if inputs are untrusted. The MusicGen fallback also appears broken by Python syntax errors.

Confidence: 97%Severity: 53%
Audit Metadata
Analyzed At
Nov 8, 2026, 07:57 AM
Package URL
pkg:socket/skills-sh/openmontageinc%2Fopenmontage%2Fhyperframes-media%2F@0be6d77fb9fd060e01dcb1462456a980ae0408b4287f9bdd0bdb257c4ca4378f