registry / @socketsecurity/cli / 1.7.0
@socketsecurity/cli@1.7.0
⚠ Under reviewCLI for Socket.dev
AI Security Review
scanned 25d ago · by lpm-firewall-aiInspected source does not substantiate the scanner’s malicious verdict, and package.json has no install lifecycle hook. The required Maven extension JAR cannot be verified as source, so the package cannot be marked clean on this inspection.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running an exposed CLI binary activates the packaged CLI; behavior of the Maven extension JAR was not determined.
Impact
No concrete impact was confirmed; the unresolved binary prevents a clean conclusion.
Mechanism
The inspected launcher starts the CLI, which imports its vendor bundle and registry utilities. The available source excerpts do not establish harmful behavior.
AI rationale
Inspected source does not substantiate the scanner’s malicious verdict, and package.json has no install lifecycle hook. The required Maven extension JAR cannot be verified as source, so the package cannot be marked clean on this inspection.
Evidence
package.jsonbin/cli.jsdist/cli.jsexternal/@socketsecurity/registry/external/libnpmpack.jsdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json lists CLI binaries and build scripts; no install lifecycle hook is present.
- bin/cli.js starts the packaged CLI, and dist/cli.js imports its vendor bundle and registry utilities.
- The flagged registry code shown reads GitHub Actions token variables and rejects when they are absent; this excerpt does not establish credential exfiltration.
- The required Maven extension JAR is binary, so its behavior could not be verified from source.
Evidence against
- The package identifies itself as a Socket.dev CLI and points to its SocketDev repository.
- The tput.js excerpt identifies a terminfo parser; it does not show dynamic evaluation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsPossibleObfuscation
Source & flagged code
17 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Findings
2 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limiteddist/vendor.js
Medium
Affected versions and remediation
This report applies to @socketsecurity/cli@1.7.0.
See all versions of @socketsecurity/cli for other recorded verdicts.
- Review the evidence and your use of @socketsecurity/cli@1.7.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.