@socketsecurity/lib@6.1.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@socketsecurity/lib@6.1.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/bin/prim.cjsView file

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto");

High

Child Process

Package source references child process execution.

dist/bin/prim.cjsView on unpkg · L61

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto"); ... L135: const starts = [0]; L136: for (let i = 0; i < src.length; i += 1) if (src.charCodeAt(i) === 10) starts.push(i + 1); L137: return starts; ... L427: mtime: X, L428: data: { ...$.data } L429: } : { ... L695: function f($, Q, J, Y, X) { L696: if (Y === "m") throw TypeError("Private method is not writable"); L697: if (Y === "a" && !X) throw TypeError("Private accessor was defined without a setter");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/prim.cjsView on unpkg · L61

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto"); ... L994: return async () => { L995: jX($.baseURL); L996: let Q = await $.identityTokenProvider(); ... L6860: if (Y) X$(`Reading through symlink: ${$} -> ${J}`); L6861: let X = fs$1(J), W = Q.readFileSync(J, { encoding: X }), G = ys(W.slice(0, 4096)); L6862: return {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin/prim.cjsView on unpkg · L61

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto"); ... L135: const starts = [0]; L136: for (let i = 0; i < src.length; i += 1) if (src.charCodeAt(i) === 10) starts.push(i + 1); L137: return starts; ... L427: mtime: X, L428: data: { ...$.data } L429: } : { ... L695: function f($, Q, J, Y, X) { L696: if (Y === "m") throw TypeError("Private method is not writable"); L697: if (Y === "a" && !X) throw TypeError("Private accessor was defined without a setter");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/prim.cjsView on unpkg · L61

23890try { L23891: return new Function(""), !0; L23892: } catch ($) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bin/prim.cjsView on unpkg · L23890

dist/temporal/now.jsView file

3Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' }); L4: const require_runtime = require('../_virtual/_rolldown/runtime.js'); L5: const require_temporal_instant = require('./instant.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/temporal/now.jsView on unpkg · L3

dist/external/npm-pack.jsView file

79const hexify = (char) => { L80: const h = char.charCodeAt(0).toString(16).toUpperCase(); L81: return `0x${h.length % 2 ? "0" : ""}${h}`; ... L203: const hasInvalidScripts = () => Object.entries(newScripts).some(([key, value]) => typeof key !== "string" || typeof value !== "string"); L204: if (hasInvalidScripts()) throw Object.assign(/* @__PURE__ */ new TypeError("package.json scripts should be a key-value pair of strings."), { code: "ESCRIPTSINVALID" }); L205: return { ... L231: var require_debug$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { L232: const debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : (... L233: module.exports = debug; ... L789: print

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/external/npm-pack.jsView on unpkg · L79

dist/bin/acorn.wasmView file

•path = dist/bin/acorn.wasm kind = wasm_module sizeBytes = 3345482 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/bin/acorn.wasmView on unpkg

dist/dlx/binary.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @socketsecurity/lib@6.0.10 matchedIdentity = npm:QHNvY2tldHNlY3VyaXR5L2xpYg:6.0.10 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dlx/binary.jsView on unpkg

Source & flagged code

9 flagged

dist/bin/prim.cjsView file

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto");

High

Child Process

Package source references child process execution.

dist/bin/prim.cjsView on unpkg · L61

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto"); ... L135: const starts = [0]; L136: for (let i = 0; i < src.length; i += 1) if (src.charCodeAt(i) === 10) starts.push(i + 1); L137: return starts; ... L427: mtime: X, L428: data: { ...$.data } L429: } : { ... L695: function f($, Q, J, Y, X) { L696: if (Y === "m") throw TypeError("Private method is not writable"); L697: if (Y === "a" && !X) throw TypeError("Private accessor was defined without a setter");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/prim.cjsView on unpkg · L61

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto"); ... L994: return async () => { L995: jX($.baseURL); L996: let Q = await $.identityTokenProvider(); ... L6860: if (Y) X$(`Reading through symlink: ${$} -> ${J}`); L6861: let X = fs$1(J), W = Q.readFileSync(J, { encoding: X }), G = ys(W.slice(0, 4096)); L6862: return {

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/bin/prim.cjsView on unpkg · L61

61node_crypto = __toESM(node_crypto, 1); L62: let child_process = require("child_process"); L63: let crypto = require("crypto"); ... L135: const starts = [0]; L136: for (let i = 0; i < src.length; i += 1) if (src.charCodeAt(i) === 10) starts.push(i + 1); L137: return starts; ... L427: mtime: X, L428: data: { ...$.data } L429: } : { ... L695: function f($, Q, J, Y, X) { L696: if (Y === "m") throw TypeError("Private method is not writable"); L697: if (Y === "a" && !X) throw TypeError("Private accessor was defined without a setter");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/prim.cjsView on unpkg · L61

23890try { L23891: return new Function(""), !0; L23892: } catch ($) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bin/prim.cjsView on unpkg · L23890

dist/temporal/now.jsView file

Lines 1-23javascript

1"use strict";

2/* Socket Lib - Built with rolldown */

3Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });

4const require_runtime = require('../_virtual/_rolldown/runtime.js');

5const

dist/external/npm-pack.jsView file

79const hexify = (char) => { L80: const h = char.charCodeAt(0).toString(16).toUpperCase(); L81: return `0x${h.length % 2 ? "0" : ""}${h}`; ... L203: const hasInvalidScripts = () => Object.entries(newScripts).some(([key, value]) => typeof key !== "string" || typeof value !== "string"); L204: if (hasInvalidScripts()) throw Object.assign(/* @__PURE__ */ new TypeError("package.json scripts should be a key-value pair of strings."), { code: "ESCRIPTSINVALID" }); L205: return { ... L231: var require_debug$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { L232: const debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : (... L233: module.exports = debug; ... L789: print

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/external/npm-pack.jsView on unpkg · L79

dist/bin/acorn.wasmView file

•path = dist/bin/acorn.wasm kind = wasm_module sizeBytes = 3345482 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/bin/acorn.wasmView on unpkg

dist/dlx/binary.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @socketsecurity/lib@6.0.10 matchedIdentity = npm:QHNvY2tldHNlY3VyaXR5L2xpYg:6.0.10 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dlx/binary.jsView on unpkg