registry / @socketsecurity/cli / 1.1.155
@socketsecurity/cli@1.1.155
CLI for Socket.dev
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has no lifecycle hooks and its sensitive operations occur only through explicit CLI commands. Scanner signals map to bundled dependencies and expected Socket CLI functionality, not a concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit execution of socket/cli commands.
Impact
Expected dependency-scanning and package-manager wrapper behavior; no unconsented install-time action found.
Mechanism
CLI scans projects and calls Socket API endpoints with its configured token.
AI rationale
The package has no lifecycle hooks and its sensitive operations occur only through explicit CLI commands. Scanner signals map to bundled dependencies and expected Socket CLI functionality, not a concrete malicious chain.
Evidence
package.jsonbin/cli.jsdist/constants.jsdist/utils.jsexternal/@socketsecurity/registry/external/libnpmpack.jsexternal/blessed/lib/tput.jsdist/cli.js
Network endpoints2
api.socket.dev/v0/api.github.com
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- User-invoked bin/cli.js spawns the packaged dist CLI.
- dist/utils.js sends authenticated requests to the Socket API.
- external/blessed/lib/tput.js uses Function for terminal capability formatting.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- bin/cli.js only runs after an explicit CLI invocation.
- dist/utils.js requires a Socket API token before authenticated API calls.
- The flagged libnpmpack.js contains bundled package-management code; no credential-exfiltration path was found.
- No foreign AI-agent configuration writes or persistence were found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
14 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
1 Critical7 High8 Medium7 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limitedexternal/@socketsecurity/registry/external/libnpmpack.js
MediumDynamic Requirebin/npm-cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
Affected versions and remediation
This report applies to @socketsecurity/cli@1.1.155.
See all versions of @socketsecurity/cli for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli@1.1.155 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.