registry / @socketsecurity/cli-with-sentry / 1.1.154
@socketsecurity/cli-with-sentry@1.1.154
CLI for Socket.dev, includes Sentry error handling, otherwise identical to the regular `socket` package
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection shows an explicitly user-invoked Socket CLI with its declared Sentry integration, not an install-time or covert malicious chain. Scanner findings map to bundled dependency functionality and expected CLI behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User invokes a provided CLI binary.
Impact
Expected diagnostic telemetry may be sent during CLI runtime; no unconsented persistence, broad config mutation, or credential exfiltration chain was confirmed.
Mechanism
CLI execution with Sentry error-reporting preload
AI rationale
Source inspection shows an explicitly user-invoked Socket CLI with its declared Sentry integration, not an install-time or covert malicious chain. Scanner findings map to bundled dependency functionality and expected CLI behavior.
Evidence
package.jsonbin/cli.jsdist/instrument-with-sentry.jsdist/shadow-npm-bin2.jsdist/utils.jsexternal/@socketsecurity/registry/external/libnpmpack.jsexternal/blessed/lib/tput.jsdist/cli.js
Network endpoints2
66736701db8e4ffac046bd09fa6aaced@o555220.ingest.us.sentry.io/4508846967619585api.socket.dev/v0/
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime Sentry telemetry is enabled in dist/instrument-with-sentry.js.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare hook.
- bin/cli.js only launches the packaged CLI after explicit bin invocation.
- Sentry setup is explicitly the package's stated with-sentry variant and sets only environment/version tags.
- The reported libnpmpack network code is bundled npm/pacote packaging logic, not credential harvesting.
- external/blessed/lib/tput.js uses Function only to compile terminal capability formatting strings.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
14 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
2 Critical6 High8 Medium7 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
MediumDynamic Requirebin/npm-cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
MediumShips Build Helper
Affected versions and remediation
This report applies to @socketsecurity/cli-with-sentry@1.1.154.
See all versions of @socketsecurity/cli-with-sentry for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli-with-sentry@1.1.154 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.