registry / socket / 1.1.144

socket@1.1.144

⚠ Under review

CLI for Socket.dev

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 24 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 247 file(s), 7.61 MB of source, external domains: 127.0.0.1, api.github.com, api.socket.dev, codeload.github.com, cve.mitre.org, cyclonedx.github.io, developer.mozilla.org, docs.github.com, docs.proxyman.io, docs.socket.dev, ecma-international.org, eev.ee, en.wikipedia.org, example.com, feross.org, gist.githubusercontent.com, github.com, mathiasbynens.be, npm.im, npms.io, registry.npmjs.org, socket.dev, tuf-repo-cdn.sigstore.dev, www.apache.org, www.scala-sbt.org

Oversized source lightweight scan

dist/vendor.js5.47 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoDynamicRequireHighEntropyStringsUrlStringsgithub.com

external/@socketsecurity/registry/external/libnpmpack.js

Source & flagged code

14 flagged

bin/cli.jsView file

19L20: const spawnPromise = spawn( L21: constants.execPath,

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L19

external/blessed/lib/tput.jsView file

1152if (this.options.stringify && code.indexOf('return ') === 0) { L1153: return new Function('', code)(); L1154: }

High

Eval

Package source references dynamic code evaluation.

external/blessed/lib/tput.jsView on unpkg · L1152

bin/npm-cli.jsView file

4void (async () => { L5: const Module = require('node:module') L6: const path = require('node:path')

Medium

Findings

3 Critical5 High8 Medium8 Low

CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js

CriticalTrigger Reachable Dangerous Capabilityexternal/@socketsecurity/registry/external/libnpmpack.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processbin/cli.js

HighShell

HighEvalexternal/blessed/lib/tput.js

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

MediumDynamic Requirebin/npm-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

Affected versions and remediation

This report applies to socket@1.1.144.

See all versions of socket for other recorded verdicts.

Review the evidence and your use of socket@1.1.144 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-23 09:56:52.661Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / socket / 1.1.144

socket@1.1.144

⚠ Under review

CLI for Socket.dev

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 24 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

Oversized source lightweight scan

dist/vendor.js5.47 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoDynamicRequireHighEntropyStringsUrlStringsgithub.com

external/@socketsecurity/registry/external/libnpmpack.js

Source & flagged code

14 flagged

bin/cli.jsView file

19L20: const spawnPromise = spawn( L21: constants.execPath,

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L19

external/blessed/lib/tput.jsView file

1152if (this.options.stringify && code.indexOf('return ') === 0) { L1153: return new Function('', code)(); L1154: }

High

Eval

Package source references dynamic code evaluation.

external/blessed/lib/tput.jsView on unpkg · L1152

bin/npm-cli.jsView file

4void (async () => { L5: const Module = require('node:module') L6: const path = require('node:path')

Medium

Findings

3 Critical5 High8 Medium8 Low

CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js

CriticalTrigger Reachable Dangerous Capabilityexternal/@socketsecurity/registry/external/libnpmpack.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processbin/cli.js

HighShell

HighEvalexternal/blessed/lib/tput.js

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar

MediumDynamic Requirebin/npm-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

Affected versions and remediation

This report applies to socket@1.1.144.

See all versions of socket for other recorded verdicts.

Review the evidence and your use of socket@1.1.144 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-23 09:56:52.661Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.