registry / @socketsecurity/cli / 1.1.167
@socketsecurity/cli@1.1.167
CLI for Socket.dev
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe high-risk findings are bundled dependencies and user-invoked CLI capabilities, not an install-time attack chain. Source inspection found no lifecycle hook or concrete unauthorized collection, exfiltration, persistence, or destructive behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes one of the installed CLI commands.
Impact
No automatic install-time mutation, persistence, or credential exfiltration was found.
Mechanism
User-invoked dependency analysis and API requests.
AI rationale
The high-risk findings are bundled dependencies and user-invoked CLI capabilities, not an install-time attack chain. Source inspection found no lifecycle hook or concrete unauthorized collection, exfiltration, persistence, or destructive behavior.
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes command-line binaries; it declares no npm install lifecycle hook.
- The launcher runs the packaged CLI only after a user invokes a command.
- The flagged terminal helper dynamically compiles terminal-formatting code.
- The registry bundle reads only proxy-related environment variables in the inspected flagged code.
- The bundled Maven artifact is a normal ZIP/JAR layout, and the CLI defaults its scan mode to avoid dependency installation.
- The vendor bundle defines a Socket API base URL for the CLI's stated service.
Evidence against
- No preinstall, install, or postinstall script is present in package.json.
- No source evidence showed automatic credential collection or exfiltration.
- Network-capable functionality is reachable through explicit CLI operations rather than package installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindings
Source & flagged code
18 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
2 Critical10 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCredential Redirect Persistencedist/vendor.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Affected versions and remediation
This report applies to @socketsecurity/cli@1.1.167.
See all versions of @socketsecurity/cli for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli@1.1.167 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.