socket@1.1.180
CLI for Socket.dev
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or concrete malicious behavior. Process execution and dynamic formatting are confined to normal CLI and terminal-library functions.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs one of the package's CLI commands.
Impact
No unconsented install-time action, credential theft, destructive behavior, or remote payload execution was identified.
Mechanism
The launcher passes user arguments to the bundled CLI; inspected output writing targets a user-selected path.
AI rationale
Static inspection found no lifecycle hook or concrete malicious behavior. Process execution and dynamic formatting are confined to normal CLI and terminal-library functions.
Evidence
package.jsonbin/cli.jsdist/cli.jsdist/vendor.jsexternal/blessed/lib/tput.jsexternal/@socketsecurity/registry/external/libnpmpack.jsdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Network endpoints2
api.socket.dev/v0socket.dev
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The inspected package metadata exposes CLI commands and its shown scripts are build-related; no install lifecycle hook was found.
- The CLI launcher starts the bundled CLI with the caller's arguments and inherited standard I/O.
- The bundled vendor configuration uses Socket-owned API and website URLs.
- The terminal library's dynamic function construction is limited to terminal capability formatting when its stringify option is enabled.
- The bundled package-packing helper runs a prepack script only while packing a directory.
- The Maven extension archive contains a Coana Socket package entry.
Evidence against
- The terminal dependency contains dynamic Function use, but the inspected call is scoped to terminal formatting.
- The CLI can spawn child processes, as expected for an explicitly invoked command-line tool.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindings
Source & flagged code
17 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
external/blessed/lib/tput.jsView file
1152if (this.options.stringify && code.indexOf('return ') === 0) {
L1153: return new Function('', code)();
L1154: }
High
Eval
Package source references dynamic code evaluation.
external/blessed/lib/tput.jsView on unpkg · L1152bin/npm-cli.jsView file
4void (async () => {
L5: const Module = require('node:module')
L6: const path = require('node:path')
Medium
Findings
2 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
HighChild Processbin/cli.js
HighShell
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
HighSemantic Analysis Limiteddist/vendor.js
Medium
Affected versions and remediation
This report applies to socket@1.1.180.
See all versions of socket for other recorded verdicts.
- Review the evidence and your use of socket@1.1.180 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.