registry / @socketsecurity/cli-with-sentry / 1.8.1
@socketsecurity/cli-with-sentry@1.8.1
⚠ Under reviewCLI for Socket.dev, includes Sentry error handling, otherwise identical to the regular `socket` package
AI Security Review
scanned 23d ago · by lpm-firewall-aiSource inspection did not establish malicious behavior, but the Maven extension is executable and its lifecycle participant bytecode could not be inspected. Manual review is needed to resolve that material gap.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking the CLI manifest workflow for a Maven project.
Impact
Potential behavior of the extension cannot be assessed from the inspected source, so the package's risk remains unresolved.
Mechanism
The CLI adds the bundled extension to Maven's extension class path and runs the validate phase; the available artifact analysis does not resolve the participants' behavior.
AI rationale
Source inspection did not establish malicious behavior, but the Maven extension is executable and its lifecycle participant bytecode could not be inspected. Manual review is needed to resolve that material gap.
Evidence
dist/cli.js.lpm-inspection-UlJPJ5/0-86f1dc8ff05b.txt
Decision evidence
public snapshotAI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The CLI invokes the bundled Maven extension through Maven's extension class path during the manifest workflow.
- The extension includes binary lifecycle participants whose behavior the offline analysis could not inspect.
- The CLI runs Maven's validate phase to trigger the extension and collect manifest records.
- The flagged npm client performs ordinary requests using the URI and request options supplied by its caller.
Evidence against
- The inspected extension caller runs as part of a specific CLI workflow; the source review did not confirm a credential transfer or other attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
17 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
2 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limiteddist/vendor.js
Medium
Affected versions and remediation
This report applies to @socketsecurity/cli-with-sentry@1.8.1.
See all versions of @socketsecurity/cli-with-sentry for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli-with-sentry@1.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.