tmux-for-interactive-commands
Warn
Audited by Socket on Apr 28, 2026
1 alert found:
AnomalyAnomalyscripts/tmux-wrapper.sh
LOWAnomalyLOW
scripts/tmux-wrapper.sh
No clear evidence of embedded malware (no obfuscation, no network/exfiltration, no persistence), but the code is a powerful automation/control wrapper that (when misused) can start arbitrary commands in tmux, inject keystrokes into interactive sessions, and capture/print pane output that may contain sensitive data. The primary supply-chain security concern is abuse risk if untrusted inputs can reach ACTION/SESSION_NAME/COMMAND/send payloads; ensure strict authorization and input validation/allow-listing for session names and commands, and minimize/secure logging of captured pane output.
Confidence: 66%Severity: 62%
Audit Metadata