wandb-autoresearch
Warn
Audited by Socket on Aug 6, 2026
1 alert found:
AnomalyAnomalyscripts/autoresearch_state_impl.py
LOWAnomalyLOW
scripts/autoresearch_state_impl.py
The module is best characterized as a legitimate-but-risky “state sync” tool that intentionally moves data to and from an external service (W&B). The ‘save’ command can upload arbitrary local files/directories specified by the user to W&B (data exfiltration risk depending on what is passed as --path). The ‘load’ command downloads remote artifacts and writes them into a local directory specified by the user (integrity/supply-chain risk depending on artifact trust). There is no clear evidence of stealthy malware/backdoors in the provided snippet, but the snippet is incomplete/truncated, reducing certainty about full behavior.
Confidence: 60%Severity: 58%
Audit Metadata