web-to-markdown
Warn
Audited by Socket on Sep 18, 2026
1 alert found:
AnomalyAnomalyscripts/fetch_generic_fallback.mjs
LOWAnomalyLOW
scripts/fetch_generic_fallback.mjs
The shown code is consistent with a generic web-page scraper and contains no clear malware indicators. It does introduce a potentially significant SSRF risk because caller-controlled URLs are fetched both by HTTP and by a headless browser without visible destination validation. Browser JavaScript execution and disabled Chromium sandboxing further increase risk in hostile environments. The risk depends on whether untrusted users can supply URLs and on controls implemented elsewhere in the larger file or application.
Confidence: 93%Severity: 62%
Audit Metadata