@socketsecurity/cli-with-sentry@1.13.0
CLI for Socket.dev, includes Sentry error handling, otherwise identical to the regular `socket` package
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe source shows automatic runtime telemetry that may include command arguments and error stacks, gated by organization configuration but not clearly disclosed in the package description. The evidence does not support a malicious verdict; the flagged credential match is an ordinary `.npmrc` exclusion rule.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Automatically when a CLI command runs; event transmission requires a configured default organization and telemetry enabled by its Socket configuration.
Impact
Command context and error details may leave the machine for Socket service analysis.
Mechanism
The CLI tracks invocation events and sends them through the organization telemetry API. Argument and error fields are sanitized, but the automatic collection and transmission are not clearly described beyond the package’s Sentry error-handling description.
AI rationale
The source shows automatic runtime telemetry that may include command arguments and error stacks, gated by organization configuration but not clearly disclosed in the package description. The evidence does not support a malicious verdict; the flagged credential match is an ordinary `.npmrc` exclusion rule.
Evidence
dist/cli.jsdist/utils.jsdist/constants.js
Network endpoints1
api.socket.dev
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Each CLI invocation starts telemetry tracking automatically.
- Telemetry context includes sanitized command arguments, and error events can include error messages and stack traces.
- Events are submitted to the configured organization’s Socket telemetry service when an organization is configured and telemetry is enabled.
- If telemetry configuration cannot be fetched, the fallback configuration disables telemetry.
Evidence against
- The manifest describes this variant as including Sentry error handling.
- The flagged `.npmrc` match is part of a registry packaging ignore list, not a credential read or transmission.
- The manifest has no install, preinstall, or postinstall lifecycle hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStrings
Source & flagged code
20 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
dist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @socketsecurity/cli-with-sentry@1.12.2
matchedIdentity = npm:[redacted]:1.12.2
similarity = 0.992
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg5155if (extension === '.ps1') {
L5156: throw new utils.InputError('This PowerShell Bazel launcher could not be resolved to a Node entry point. Pass a native .exe, a .cmd or .bat wrapper, or a JavaScript entry point with...
L5157: }
Findings
3 Critical9 High9 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/cli.js
HighShelldist/cli.js
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Affected versions and remediation
This report applies to @socketsecurity/cli-with-sentry@1.13.0.
See all versions of @socketsecurity/cli-with-sentry for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli-with-sentry@1.13.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.