vet-generator
Warn
Audited by Socket on May 7, 2026
1 alert found:
AnomalyAnomalyscripts/inject-vet.mjs
LOWAnomalyLOW
scripts/inject-vet.mjs
No direct malicious behaviors (e.g., credential theft, system command execution, or network exfiltration) are evident in this specific loader module. However, it performs high-impact dynamic code execution by injecting and evaluating the full local vet.js contents in a live target browser tab via CDP Runtime.evaluate, and it writes page-derived results to a caller-controlled file path without destination validation. The true malware likelihood is low based on this snippet alone, but the security risk is moderate because compromise/tampering of vet.js (or CDP targeting) would directly yield arbitrary in-page script execution.
Confidence: 62%Severity: 62%
Audit Metadata