registry / socket / 1.1.137

socket@1.1.137

CLI for Socket.dev

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 20 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 247 file(s), 7.61 MB of source, external domains: 127.0.0.1, api.github.com, api.socket.dev, codeload.github.com, cve.mitre.org, cyclonedx.github.io, developer.mozilla.org, docs.github.com, docs.proxyman.io, docs.socket.dev, ecma-international.org, eev.ee, en.wikipedia.org, example.com, feross.org, gist.githubusercontent.com, github.com, mathiasbynens.be, npm.im, npms.io, registry.npmjs.org, socket.dev, tuf-repo-cdn.sigstore.dev, www.apache.org, www.scala-sbt.org

Oversized source lightweight scan

dist/vendor.js4.97 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoDynamicRequireHighEntropyStringsUrlStringsgithub.com

external/@socketsecurity/registry/external/libnpmpack.js3.25 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringscodeload.github.comgist.githubusercontent.com

external/@socketsecurity/registry/external/pacote.js2.25 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringscodeload.github.comgist.githubusercontent.comregistry.npmjs.orgtuf-repo-cdn.sigstore.devwww.apache.org

Source & flagged code

10 flagged

bin/cli.jsView file

19L20: const spawnPromise = spawn( L21: constants.execPath,

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L19

external/blessed/lib/tput.jsView file

Lines 1132-1172javascript

1132 code = code.replace(

1133 /out = \[\];out\.push$("(?:[^"]|\\")+")$,/,

1134 'out = [$1];');

1135 }

1136

1137 // Terminfos `wyse350-vb`, and `wy350-w`

1138 // seem to have a few broken strings.

1139 if (str === '\u001b%?') {

1140 code = 'return "\\x1b";';

1141 }

1142

1143 if (this.debug) {

1144 v = code

1145 .replace(/\x1b/g, '\\x1b')

1146 .replace(/\r/g, '\\r')

1147 .replace(/\n/g, '\\n');

1148 process.stdout.write(v + '\n');

1149 }

1150

1151 try {

1152 if (this.options.stringify && code.indexOf('return ') === 0) {

1153 return new Function('', code)();

1154 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

external/blessed/lib/tput.jsView on unpkg · L1152

1155 return this.printf || ~code.indexOf('sprintf(')

1156 ? new Function('sprintf, params', code).bind(null, sprintf)

1157 : new Function('params', code);

1158 } catch (e) {

1159 console.error('');

1160 console.error('Error on %s:', tkey);

1161 console.error(JSON.stringify(str));

1162 console.error('');

1163 console.error(code.replace(/(,|;)/g, '$1\n'));

1164 e.stack = e.stack.replace(/\x1b/g, '\\x1b');

1165 throw e;

1166 }

1167};

1168

1169// See: ~/ncurses/ncurses/tinfo/lib_tputs.c

1170Tput.prototype._print = function(code, print, done) {

1171 var xon = !this.bools.needs_xon_xoff || this.bools.xon_xoff;

1172

bin/npm-cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

4var shadowNpmBin = require('./shadow-npm-bin2.js');

6void (async () => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/npm-cli.jsView on unpkg · L4

7 process.exitCode = 1

dist/cli.jsView file

21Cross-file remote execution chain: dist/cli.js spawns external/blessed-contrib/lib/widget/charts/line.js; helper contains network access plus dynamic code execution. L21: var bin = require('../external/@socketsecurity/registry/lib/bin'); L22: var childProcess = require('node:child_process'); L23: var fs$2 = require('../external/@socketsecurity/registry/lib/fs'); ... L83: if (!result.ok) { L84: process.exitCode = result.code ?? 1; L85: } ... L185: titles: Object.keys(data.top_five_alert_types), L186: data: Object.values(data.top_five_alert_types) L187: }); ... L1036: const { L1037: cwd = process.cwd(), L1038: defaultBranch,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L21

21var bin = require('../external/@socketsecurity/registry/lib/bin'); L22: var childProcess = require('node:child_process'); L23: var fs$2 = require('../external/@socketsecurity/registry/lib/fs'); ... L83: if (!result.ok) { L84: process.exitCode = result.code ?? 1; L85: } ... L185: titles: Object.keys(data.top_five_alert_types), L186: data: Object.values(data.top_five_alert_types) L187: }); ... L1036: const { L1037: cwd = process.cwd(), L1038: defaultBranch,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L21

dist/socket-completion.bashView file

•path = dist/socket-completion.bash kind = build_helper sizeBytes = 8951 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/socket-completion.bashView on unpkg

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView file

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = high_entropy_blob sizeBytes = 62321 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = compressed_blob sizeBytes = 62321 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = nested_archive_needs_inspection sizeBytes = 62321 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

dist/vendor.jsView file

•path = dist/vendor.js kind = oversized_source_file sizeBytes = 5213726 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/vendor.jsView on unpkg

Source & flagged code

10 flagged · loading source

bin/cli.jsView file

19L20: const spawnPromise = spawn( L21: constants.execPath,

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L19

external/blessed/lib/tput.jsView file

1152if (this.options.stringify && code.indexOf('return ') === 0) { L1153: return new Function('', code)(); L1154: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

external/blessed/lib/tput.jsView on unpkg · L1152

bin/npm-cli.jsView file

4void (async () => { L5: const Module = require('node:module') L6: const path = require('node:path')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/npm-cli.jsView on unpkg · L4

dist/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L21

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L21

dist/socket-completion.bashView file

•path = dist/socket-completion.bash kind = build_helper sizeBytes = 8951 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/socket-completion.bashView on unpkg

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView file

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = high_entropy_blob sizeBytes = 62321 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = compressed_blob sizeBytes = 62321 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = nested_archive_needs_inspection sizeBytes = 62321 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

dist/vendor.jsView file

•path = dist/vendor.js kind = oversized_source_file sizeBytes = 5213726 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/vendor.jsView on unpkg

Findings

5 High7 Medium8 Low

HighChild Processbin/cli.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

HighOversized Source Filedist/vendor.js

MediumDynamic Requirebin/npm-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumShips Build Helperdist/socket-completion.bash

MediumShips Compressed Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalexternal/blessed/lib/tput.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist/manifest-scripts/maven-extension/coana-maven-extension.jar

Source & flagged code

10 flagged

bin/cli.jsView file

19L20: const spawnPromise = spawn( L21: constants.execPath,

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L19

external/blessed/lib/tput.jsView file

Lines 1132-1172javascript

1132 code = code.replace(

1133 /out = \[\];out\.push$("(?:[^"]|\\")+")$,/,

1134 'out = [$1];');

1135 }

1136

1137 // Terminfos `wyse350-vb`, and `wy350-w`

1138 // seem to have a few broken strings.

1139 if (str === '\u001b%?') {

1140 code = 'return "\\x1b";';

1141 }

1142

1143 if (this.debug) {

1144 v = code

1145 .replace(/\x1b/g, '\\x1b')

1146 .replace(/\r/g, '\\r')

1147 .replace(/\n/g, '\\n');

1148 process.stdout.write(v + '\n');

1149 }

1150

1151 try {

1152 if (this.options.stringify && code.indexOf('return ') === 0) {

1153 return new Function('', code)();

1154 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

external/blessed/lib/tput.jsView on unpkg · L1152

1155 return this.printf || ~code.indexOf('sprintf(')

1156 ? new Function('sprintf, params', code).bind(null, sprintf)

1157 : new Function('params', code);

1158 } catch (e) {

1159 console.error('');

1160 console.error('Error on %s:', tkey);

1161 console.error(JSON.stringify(str));

1162 console.error('');

1163 console.error(code.replace(/(,|;)/g, '$1\n'));

1164 e.stack = e.stack.replace(/\x1b/g, '\\x1b');

1165 throw e;

1166 }

1167};

1168

1169// See: ~/ncurses/ncurses/tinfo/lib_tputs.c

1170Tput.prototype._print = function(code, print, done) {

1171 var xon = !this.bools.needs_xon_xoff || this.bools.xon_xoff;

1172

bin/npm-cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

4var shadowNpmBin = require('./shadow-npm-bin2.js');

6void (async () => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/npm-cli.jsView on unpkg · L4

7 process.exitCode = 1

dist/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L21

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L21

dist/socket-completion.bashView file

•path = dist/socket-completion.bash kind = build_helper sizeBytes = 8951 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/socket-completion.bashView on unpkg

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView file

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = high_entropy_blob sizeBytes = 62321 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = compressed_blob sizeBytes = 62321 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

•path = dist/manifest-scripts/maven-extension/coana-maven-extension.jar kind = nested_archive_needs_inspection sizeBytes = 62321 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/manifest-scripts/maven-extension/coana-maven-extension.jarView on unpkg

dist/vendor.jsView file

•path = dist/vendor.js kind = oversized_source_file sizeBytes = 5213726 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/vendor.jsView on unpkg