registry / @socketsecurity/cli-with-sentry / 1.2.0
@socketsecurity/cli-with-sentry@1.2.0
CLI for Socket.dev, includes Sentry error handling, otherwise identical to the regular `socket` package
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found user-invoked CLI behavior and bundled dependencies, but no automatic lifecycle execution or concrete malicious behavior. The observed powerful primitives are not sufficient evidence of an attack without an automatic or malicious activation path.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes one of the package command-line binaries.
Impact
No unconsented installation-time execution, credential theft, persistence, or destructive behavior was established.
Mechanism
The launcher starts the bundled CLI with the user-provided arguments.
AI rationale
Static inspection found user-invoked CLI behavior and bundled dependencies, but no automatic lifecycle execution or concrete malicious behavior. The observed powerful primitives are not sufficient evidence of an attack without an automatic or malicious activation path.
Decision evidence
public snapshotAI called this Clean at 87.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package manifest exposes command-line binaries and its script table contains build and test commands, with no install lifecycle hook.
- The primary launcher spawns the bundled CLI only when the user invokes its binary.
- The inspected bundled artifacts implement CLI and dependency-packaging functionality; no automatic attack path was identified.
- The bundled Java archive contains named Maven extension classes rather than an executable install hook.
Evidence against
- Bundled third-party code includes child-process and dynamic-function primitives, but no package lifecycle trigger activates them automatically.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
2 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limiteddist/vendor.js
Medium
Affected versions and remediation
This report applies to @socketsecurity/cli-with-sentry@1.2.0.
See all versions of @socketsecurity/cli-with-sentry for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli-with-sentry@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.