azure-pipelines-validator

Fail

Audited by Socket on Mar 28, 2026

1 alert found:

Malware
MalwareHIGH
examples/regression-conditional-danger.yml

This Azure DevOps pipeline fragment implements a highly suspicious and effectively arbitrary remote code execution mechanism: on `main` builds it downloads an unverified script from an external domain and executes it via `bash`. The lack of integrity/authenticity controls plus the `curl | bash` pattern make this consistent with CI/CD supply-chain malware delivery and artifact sabotage.

Confidence: 90%Severity: 100%
Audit Metadata
Analyzed At
Mar 28, 2026, 06:19 PM
Package URL
pkg:socket/skills-sh/akin-ozer%2Fcc-devops-skills%2Fazure-pipelines-validator%2F@96c8d991055a4f2c3bfe3e7e115e9e96ac7f9e7c