registry / @socketsecurity/cli-with-sentry / 1.1.143
@socketsecurity/cli-with-sentry@1.1.143
⚠ Under reviewCLI for Socket.dev, includes Sentry error handling, otherwise identical to the regular `socket` package
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsObfuscatedUrlStrings
Oversized source lightweight scan
dist/vendor.js5.47 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoDynamicRequireHighEntropyStringsUrlStrings
Source & flagged code
11 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
1 Critical5 High7 Medium8 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/cli.js
HighShell
HighCross File Remote Execution Contextdist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighOversized Source Filedist/vendor.js
MediumDynamic Requirebin/npm-cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumShips Build Helperdist/socket-completion.bash
MediumShips Compressed Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Medium
Affected versions and remediation
This report applies to @socketsecurity/cli-with-sentry@1.1.143.
See all versions of @socketsecurity/cli-with-sentry for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli-with-sentry@1.1.143 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.