Packages which introduce init(...) likely need to be audited: these are called during execution and mean that libraries can execute their own behavior at runtime regardless of whether or not affected methods are called.
E.g., it might be alright if CAPABILITY_EXEC was used in a library to help with command execution, but I'd in general be surprised about an init(...) function in that context and especially if init(...) called exec(...) in some way. Introduction (or initial use) of init in libraries should probably be audited, along with periodic re-reviews on version bumps.
Packages which introduce
init(...)likely need to be audited: these are called during execution and mean that libraries can execute their own behavior at runtime regardless of whether or not affected methods are called.E.g., it might be alright if
CAPABILITY_EXECwas used in a library to help with command execution, but I'd in general be surprised about aninit(...)function in that context and especially ifinit(...)calledexec(...)in some way. Introduction (or initial use) ofinitin libraries should probably be audited, along with periodic re-reviews on version bumps.