cover
Warn
Audited by Socket on Sep 2, 2026
1 alert found:
AnomalyAnomalyindex.js
LOWAnomalyLOW
index.js
This module is a build/orchestration helper that ingests untrusted quote text/JSON, writes it to a temp JSON file, and then executes a local `generate.sh` via `bash` to render PNG artifacts. There is no visible direct malware logic (no network calls, no credential access, no eval/Function), but the execution of an external shell script with arguments derived from caller-controlled paths and untrusted content constitutes a significant supply-chain/execution risk. Security ultimately hinges on `generate.sh` and upstream validation of `outputDir` and the quote content.
Confidence: 55%Severity: 62%
Audit Metadata