yufan-Agnes
Warn
Audited by Socket on Jun 2, 2026
1 alert found:
AnomalyAnomalybridge/src/deps.js
LOWAnomalyLOW
bridge/src/deps.js
This module is primarily an installer helper for the `cloudflared` binary. It does not show clear malicious intent (no evidence of data theft, persistence, or covert execution). The main security concern is that it can automatically perform privileged, high-impact system changes—especially on Linux—by executing shell-based commands that download remote signing material/repo configuration and run package manager installs (gated only by `options.install`, which defaults to enabled). This should be reviewed and executed in a context where installation side effects and supply-chain trust are acceptable.
Confidence: 70%Severity: 52%
Audit Metadata