registry / @socketsecurity/cli-with-sentry / 1.12.1
@socketsecurity/cli-with-sentry@1.12.1
CLI for Socket.dev, includes Sentry error handling, otherwise identical to the regular `socket` package
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package runs a Socket CLI wrapper, with no install lifecycle hook in the manifest. The flagged credential location is ordinary npm pack-list logic, and telemetry is gated by organization configuration with disabled fallback and argument sanitization.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
CLI invocation; telemetry is submitted only when a configured organization’s Socket settings enable it.
Impact
No malicious impact identified.
Mechanism
The launcher passes the user's arguments to the CLI. Telemetry uses sanitized arguments and runtime metadata; the apparent credential match is an npm ignore-rule list.
AI rationale
The package runs a Socket CLI wrapper, with no install lifecycle hook in the manifest. The flagged credential location is ordinary npm pack-list logic, and telemetry is gated by organization configuration with disabled fallback and argument sanitization.
Network endpoints1
api.socket.dev
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes CLI wrapper executables for Socket and package managers.
- The launcher forwards user-supplied arguments to the bundled CLI process.
- Telemetry falls back to disabled when configuration cannot be fetched and sends events only when an organization is configured.
- Telemetry records sanitized arguments plus platform, architecture, Node version, and package version.
- The flagged libnpmpack location contains npm pack-list ignore rules, not credential transmission.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
19 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
dist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @socketsecurity/cli-with-sentry@1.8.4
matchedIdentity = npm:[redacted]:1.8.4
similarity = 0.950
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg4516if (extension === '.ps1') {
L4517: throw new utils.InputError('This PowerShell Bazel launcher could not be resolved to a Node entry point. Pass a native .exe, a .cmd or .bat wrapper, or a JavaScript entry point with...
L4518: }
Findings
3 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/cli.js
HighShelldist/cli.js
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Affected versions and remediation
This report applies to @socketsecurity/cli-with-sentry@1.12.1.
See all versions of @socketsecurity/cli-with-sentry for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli-with-sentry@1.12.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.