mailhog

Warn

Audited by Socket on Mar 30, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/mailhog_manager.sh

No explicit backdoor/exfiltration logic is present in this snippet, but it contains multiple high-impact security weaknesses: it executes the configuration file as shell code (`source`), builds and executes an unquoted command string from variable inputs (command injection risk), and installs a remote binary from GitHub release ZIPs without integrity verification. Cleanup includes potentially destructive `rm -rf` based on a user/config-controlled maildir path. Treat this script as security-critical and harden it before use in untrusted environments (e.g., parse config as data, avoid string-based command execution, and verify downloaded artifacts).

Confidence: 74%Severity: 78%
Audit Metadata
Analyzed At
Mar 30, 2026, 02:22 AM
Package URL
pkg:socket/skills-sh/whamp%2Fwhamp-claude-tools%2Fmailhog%2F@3ba81d33f76b281aceecaac2ca5686fee9878c84
Security Audit — socket — mailhog