get-biji
Warn
Audited by Socket on Oct 20, 2026
1 alert found:
AnomalyAnomalyscripts/dedupe.js
LOWAnomalyLOW
scripts/dedupe.js
This utility deduplicates Markdown summaries and deletes duplicate summaries and their associated transcript paths. Because transcript paths come from unvalidated frontmatter, a crafted value containing ../ can cause deletion outside the notes directory when its summary is in a duplicate group. This is a moderate destructive file-operation risk; no evidence of data exfiltration or other malware behavior is present.
Confidence: 98%Severity: 55%
Audit Metadata