lavarage

Warn

Audited by Socket on Apr 20, 2026

1 alert found:

Anomaly
AnomalyLOW
examples/open-short.ts

No explicit malware patterns (e.g., persistence mechanisms, credential exfiltration, obfuscated code, or direct off-platform data theft) are evident in this snippet. The dominant security concern is operational/trust risk: the module blindly signs and submits transaction bytes returned by a third-party API. If that API (or the returned transaction) is compromised or behaves unexpectedly, the signer may authorize unintended on-chain actions. Additionally, hardcoding a long production-like identifier/token string into source code is a supply-chain/config credential exposure risk. Overall: likely a DeFi/trading automation module with elevated risk due to blind signing of externally constructed transactions rather than classic malicious payload behavior.

Confidence: 60%Severity: 63%
Audit Metadata
Analyzed At
Apr 20, 2026, 12:05 PM
Package URL
pkg:socket/skills-sh/sendaifun%2Fskills%2Flavarage%2F@8b45c46beb33df2ce1d680f7c5c97298f5ac4a19