nicepay-devguide
Warn
Audited by Socket on May 6, 2026
1 alert found:
AnomalyAnomalylaunch-devguide.cjs
LOWAnomalyLOW
launch-devguide.cjs
This wrapper itself is a minimal CLI launcher, but it executes a local bundled artifact without any integrity verification, forwards the entire environment to the child, and inherits stdio. As a result, security risk is moderate: if the vendored bundle is tampered with or compromised, the code will execute it immediately with broad environmental and I/O exposure. No strong indicators of malicious logic are present in the wrapper alone, but the trust boundary is high.
Confidence: 60%Severity: 50%
Audit Metadata