mailhog
Warn
Audited by Socket on Mar 30, 2026
1 alert found:
SecuritySecurityscripts/mailhog_manager.sh
MEDIUMSecurityMEDIUM
scripts/mailhog_manager.sh
No explicit backdoor/exfiltration logic is present in this snippet, but it contains multiple high-impact security weaknesses: it executes the configuration file as shell code (`source`), builds and executes an unquoted command string from variable inputs (command injection risk), and installs a remote binary from GitHub release ZIPs without integrity verification. Cleanup includes potentially destructive `rm -rf` based on a user/config-controlled maildir path. Treat this script as security-critical and harden it before use in untrusted environments (e.g., parse config as data, avoid string-based command execution, and verify downloaded artifacts).
Confidence: 74%Severity: 78%
Audit Metadata