registry / socket / 1.1.143

socket@1.1.143

⚠ Under review

CLI for Socket.dev

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 247 file(s), 7.61 MB of source, external domains: 127.0.0.1, api.github.com, api.socket.dev, codeload.github.com, cve.mitre.org, cyclonedx.github.io, developer.mozilla.org, docs.github.com, docs.proxyman.io, docs.socket.dev, ecma-international.org, eev.ee, en.wikipedia.org, example.com, feross.org, gist.githubusercontent.com, github.com, mathiasbynens.be, npm.im, npms.io, registry.npmjs.org, socket.dev, tuf-repo-cdn.sigstore.dev, www.apache.org, www.scala-sbt.org

Oversized source lightweight scan

dist/vendor.js5.47 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoDynamicRequireHighEntropyStringsUrlStringsgithub.com

external/@socketsecurity/registry/external/libnpmpack.js

Source & flagged code

11 flagged

bin/cli.jsView file

19L20: const spawnPromise = spawn( L21: constants.execPath,

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L19

external/blessed/lib/tput.jsView file

1152if (this.options.stringify && code.indexOf('return ') === 0) { L1153: return new Function('', code)(); L1154: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

external/blessed/lib/tput.jsView on unpkg · L1152

bin/npm-cli.jsView file

4void (async () => { L5: const Module = require('node:module') L6: const path = require('node:path')

Medium

Findings

1 Critical5 High7 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processbin/cli.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

HighOversized Source Filedist/vendor.js

MediumDynamic Requirebin/npm-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumShips Build Helperdist/socket-completion.bash

MediumShips Compressed Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

Medium

Affected versions and remediation

This report applies to socket@1.1.143.

See all versions of socket for other recorded verdicts.

Review the evidence and your use of socket@1.1.143 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-10 16:19:34.385Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / socket / 1.1.143

socket@1.1.143

⚠ Under review

CLI for Socket.dev

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

Oversized source lightweight scan

dist/vendor.js5.47 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoDynamicRequireHighEntropyStringsUrlStringsgithub.com

external/@socketsecurity/registry/external/libnpmpack.js

Source & flagged code

11 flagged

bin/cli.jsView file

19L20: const spawnPromise = spawn( L21: constants.execPath,

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L19

external/blessed/lib/tput.jsView file

1152if (this.options.stringify && code.indexOf('return ') === 0) { L1153: return new Function('', code)(); L1154: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

external/blessed/lib/tput.jsView on unpkg · L1152

bin/npm-cli.jsView file

4void (async () => { L5: const Module = require('node:module') L6: const path = require('node:path')

Medium

Findings

1 Critical5 High7 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processbin/cli.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

HighOversized Source Filedist/vendor.js

MediumDynamic Requirebin/npm-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumShips Build Helperdist/socket-completion.bash

MediumShips Compressed Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

Medium

Affected versions and remediation

This report applies to socket@1.1.143.

See all versions of socket for other recorded verdicts.

Review the evidence and your use of socket@1.1.143 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-10 16:19:34.385Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.