debugging-code
Warn
Audited by Socket on Aug 5, 2026
1 alert found:
AnomalyAnomalyscripts/install-dap.sh
LOWAnomalyLOW
scripts/install-dap.sh
This module is a network-based installer that downloads an executable from GitHub Releases and installs it to a standard binary directory, and it also supports a fallback that runs 'go install ...@latest'. There is no cryptographic integrity/authenticity verification of the downloaded artifact, and version selection is mutable ('latest' for both release and Go fallback), creating a meaningful supply-chain attack surface. No direct evidence of malware or backdoor behavior exists in the shown code, but the integrity guarantees are weak and should be addressed for secure deployments.
Confidence: 72%Severity: 67%
Audit Metadata