registry / @socketsecurity/cli-with-sentry / 1.4.1
@socketsecurity/cli-with-sentry@1.4.1
CLI for Socket.dev, includes Sentry error handling, otherwise identical to the regular `socket` package
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected behaviors align with a dependency-security CLI and its Sentry-enabled build. Static inspection found no concrete malicious chain warranting warning or blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The caller invokes the CLI or its package-manager wrappers; no automatic install hook was found.
Impact
No malicious credential harvesting, destructive action, or unconsented agent-control mutation was established.
Mechanism
The CLI dispatches commands, runs build tools for dependency analysis, and reports telemetry through its SDK and Sentry.
AI rationale
Inspected behaviors align with a dependency-security CLI and its Sentry-enabled build. Static inspection found no concrete malicious chain warranting warning or blocking.
Network endpoints2
registry.npmjs.org/o555220.ingest.us.sentry.io
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no registry-install lifecycle hooks or runtime self-dependency.
- bin/cli.js launches the bundled CLI with the caller's arguments.
- Dynamic functions in tput.js and dist/vendor.js compile terminal capabilities and schema validators.
- libnpmpack.js runs packing scripts only for directory inputs when scripts are enabled.
- dist/cli.js invokes the bundled Maven extension for dependency records; the archive contains SocketFactsRecordsEngine.class.
- Sentry initialization configures error reporting with no automatic integrations; inspected telemetry uses the Socket SDK.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
2 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limiteddist/vendor.js
Medium
Affected versions and remediation
This report applies to @socketsecurity/cli-with-sentry@1.4.1.
See all versions of @socketsecurity/cli-with-sentry for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli-with-sentry@1.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.