vet-generator

Warn

Audited by Socket on May 7, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/inject-vet.mjs

No direct malicious behaviors (e.g., credential theft, system command execution, or network exfiltration) are evident in this specific loader module. However, it performs high-impact dynamic code execution by injecting and evaluating the full local vet.js contents in a live target browser tab via CDP Runtime.evaluate, and it writes page-derived results to a caller-controlled file path without destination validation. The true malware likelihood is low based on this snippet alone, but the security risk is moderate because compromise/tampering of vet.js (or CDP targeting) would directly yield arbitrary in-page script execution.

Confidence: 62%Severity: 62%
Audit Metadata
Analyzed At
May 7, 2026, 03:10 AM
Package URL
pkg:socket/skills-sh/hixuanxuan%2Fbrowser-automation%2Fvet-generator%2F@a9f059fffae0d893c15f2fcb7b882ed24d42f28e