nature-downloader

Fail

Audited by Socket on Oct 11, 2026

1 alert found:

Malware
MalwareHIGH
scripts/lib/anti-bot.mjs

This module is highly consistent with abusive anti-bot/captcha bypass automation: it detects slider and reCAPTCHA challenge elements in the target DOM, executes browser-context JavaScript to trigger synthetic user actions, and uses CDP-driven mouse events to perform human-like dragging/clicking, followed by heuristic success checks and retries. While no direct data theft is visible in the provided fragment, the intended functionality undermines security controls (human verification) and is therefore a serious security risk in most deployment contexts.

Confidence: 86%Severity: 95%
Audit Metadata
Analyzed At
Oct 11, 2026, 08:58 AM
Package URL
pkg:socket/skills-sh/yuan1z0825%2Fnature-skills%2Fnature-downloader%2F@e03c64da4ca7cb670de938e25ae313636bbfc4bf40d0a60dee2d5dc11fe7e0fe