socket@1.11.1
⚠ Under reviewCLI for Socket.dev
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe flagged credential and dynamic-code indicators are consistent with bundled registry and terminal-library functionality, and the manifest has no install hook. The executable Maven extension is activated by a CLI inference path, but its behavior remains unresolved in the available analysis, so manual review is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user invokes Maven-based manifest inference through the CLI, which runs Maven's validate phase with the extension loaded.
Impact
The extension's possible side effects remain unknown; no specific data transfer or destructive action was established.
Mechanism
The CLI adds the bundled JAR to Maven's extension classpath; the inspected artifact lists Java lifecycle and event classes but provides no review of their method behavior.
AI rationale
The flagged credential and dynamic-code indicators are consistent with bundled registry and terminal-library functionality, and the manifest has no install hook. The executable Maven extension is activated by a CLI inference path, but its behavior remains unresolved in the available analysis, so manual review is appropriate.
Evidence
dist/cli.js.lpm-inspection-On0Ehg/0-da5713f359d2.txtdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Decision evidence
public snapshotAI called this Manual Review at 84.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The Maven CLI loads the bundled JAR as a Maven extension during a manifest inference command.
- Offline artifact analysis identifies Java lifecycle and event classes but says their behavior needs further inspection; their effects remain unresolved.
- The manifest exposes CLI entrypoints and inspected scripts show build and development tasks, with no install lifecycle hook.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
19 flaggedbin/cli.jsView file
19L20: const spawnPromise = spawn(
L21: constants.execPath,
High
dist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = socket@1.11.0
matchedIdentity = npm:c29ja2V0:1.11.0
similarity = 0.975
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg4516if (extension === '.ps1') {
L4517: throw new utils.InputError('This PowerShell Bazel launcher could not be resolved to a Node entry point. Pass a native .exe, a .cmd or .bat wrapper, or a JavaScript entry point with...
L4518: }
High
Shell
Package source references shell execution.
Findings
3 Critical9 High8 Medium6 Low
CriticalCredential Exfiltrationexternal/@socketsecurity/registry/external/libnpmpack.js
CriticalTrigger Reachable Dangerous Capabilitydist/vendor.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/cli.js
HighShelldist/cli.js
HighEvalexternal/blessed/lib/tput.js
HighCommand Output Exfiltrationdist/vendor.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/vendor.js
HighTrigger Reachable Persistencedist/cli.js
HighShips High Entropy Blobdist/manifest-scripts/maven-extension/coana-maven-extension.jar
Affected versions and remediation
This report applies to socket@1.11.1.
See all versions of socket for other recorded verdicts.
- Review the evidence and your use of socket@1.11.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.