registry / @socketsecurity/cli / 1.1.153
@socketsecurity/cli@1.1.153
CLI for Socket.dev
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner findings correspond to a security CLI's user-invoked process wrapping, API authentication, and bundled npm/Maven components. No lifecycle execution, stealth persistence, remote payload execution, or unconsented credential exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User invokes a Socket CLI or wrapper command.
Impact
No confirmed malicious behavior.
Mechanism
User-invoked package-manager wrapping and Socket API scanning
AI rationale
The scanner findings correspond to a security CLI's user-invoked process wrapping, API authentication, and bundled npm/Maven components. No lifecycle execution, stealth persistence, remote payload execution, or unconsented credential exfiltration was found.
Evidence
package.jsonbin/cli.jsdist/cli.jsdist/utils.jsexternal/@socketsecurity/registry/external/libnpmpack.jsdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Network endpoints1
api.socket.dev/v0/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/cli.js has a hidden --postinstall wrapper path that can edit shell rc files after an interactive prompt.
Evidence against
- package.json defines no preinstall, install, postinstall, or prepare lifecycle hook.
- bin/cli.js only runs when its CLI binary is invoked.
- dist/cli.js requires explicit wrapper/completion commands for shell-file changes.
- dist/utils.js sends authenticated requests only to configured Socket API endpoints.
- libnpmpack.js is bundled npm/pacote registry code; no package-specific credential exfiltration was found.
- The JAR is a listed Maven extension archive with named classes, not an executed install hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsObfuscated
Source & flagged code
14 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
1 Critical7 High8 Medium7 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limitedexternal/@socketsecurity/registry/external/libnpmpack.js
MediumDynamic Requirebin/npm-cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
Affected versions and remediation
This report applies to @socketsecurity/cli@1.1.153.
See all versions of @socketsecurity/cli for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli@1.1.153 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.