| Block |
 |
Obfuscated code: npm fast-xml-parser is 90.0% likely obfuscated
Confidence: 0.90
Location: Package overview
From: ? → npm/@react-native-community/cli-platform-android@20.0.0 → npm/@react-native-community/cli-platform-ios@20.0.0 → npm/@react-native-community/cli@20.0.0 → npm/fast-xml-parser@4.5.7
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Block |
|
Obfuscated code: npm js-yaml is 90.0% likely obfuscated
Confidence: 0.90
Location: Package overview
From: package.json → npm/js-yaml@4.2.0
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/js-yaml@4.2.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Block |
|
Obfuscated code: npm sjcl is 90.0% likely obfuscated
Confidence: 0.90
Location: Package overview
From: ? → npm/react-native-randombytes@3.6.1 → npm/sjcl@1.0.9
ℹ Read more on: This package | This alert | What is obfuscated code?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/sjcl@1.0.9. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Block |
 |
Network access: npm @simple-git/argv-parser in module globalThis["fetch"]
Module: globalThis["fetch"]
Location: Package overview
From: ? → npm/simple-git@3.36.0 → npm/@simple-git/argv-parser@1.1.1
ℹ Read more on: This package | This alert | What is network access?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@simple-git/argv-parser@1.1.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Block |
|
Potential security risk (AI signal): npm lodash-es is 80.0% likely risky
Notes: No overt malware/backdoor/IO/exfiltration behavior is present in this module itself. However, it is a high-risk template compiler because it dynamically generates and compiles JavaScript via Function(...) using template-derived fragments and caller-supplied configuration. In particular, the evaluate directive inserts raw JavaScript into the generated source, and with (obj) broadens scope when variable is unset. Treat template strings and especially evaluate/interpolate content and options as fully trusted or strictly controlled; otherwise, this can enable arbitrary code execution in the context of the application.
Confidence: 0.80
Severity: 0.70
From: ? → npm/@myx-trade/sdk@0.1.265 → npm/@metamask/test-dapp-solana@0.3.1 → npm/lodash-es@4.18.1
ℹ Read more on: This package | This alert | What are AI-detected potential security risks?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/lodash-es@4.18.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Warn |
 |
Potential code anomaly (AI signal): npm @babel/core is 68.0% likely to have a medium risk anomaly
Notes: A module in package/lib/errors/rewrite-stack-trace.js manipulates error stack traces by overriding Error.prepareStackTrace and adjusting stackTraceLimit, allowing selective hiding or revealing of frames and injecting synthetic frames. This can obfuscate error reporting and reduce forensic visibility; it is not inherently malicious but should be tightly controlled and documented for security-sensitive environments.
Confidence: 0.68
Severity: 0.52
From: package.json → npm/@babel/core@8.0.1
ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@babel/core@8.0.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Warn |
|
Potential code anomaly (AI signal): npm esbuild is 90.0% likely to have a medium risk anomaly
Notes: The esbuild package uses a postinstall install.js script to download platform-specific binaries from registry sources and verify them via hashes. While hash verification reduces risk, the elevated postinstall action creates a potential code-execution surface if the script is tampered with. Audit install.js and its endpoints, ensure artifacts are strictly verified against known hashes, and test in controlled environments before deployment.
Confidence: 0.90
Severity: 0.60
From: package.json → npm/esbuild@0.28.1
ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/esbuild@0.28.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Warn |
|
Potential code anomaly (AI signal): npm fast-xml-parser is 65.0% likely to have a medium risk anomaly
Notes: BufferSource.js implements a simple buffer-based parser for XML-like content, providing methods such as readCh, readChAt, readStr, readUpto, readUptoCloseTag, readFromBuffer, updateBufferBoundary, and canRead. While it contains no network calls, file writes, eval calls, or secret leaks, several methods lack full bounds checking (notably readChAt) and the custom stop-string matching in readUpto/readUptoCloseTag may exhibit off-by-one or out-of-bounds errors on malformed input. These shortcomings can lead to runtime exceptions or incorrect parsing state but do not constitute malicious behavior. Overall risk is low and limited to potential parser crashes under unexpected input.
Confidence: 0.65
Severity: 0.55
From: ? → npm/@react-native-community/cli-platform-android@20.0.0 → npm/@react-native-community/cli-platform-ios@20.0.0 → npm/@react-native-community/cli@20.0.0 → npm/fast-xml-parser@4.5.7
ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
| Warn |
|
Potential code anomaly (AI signal): npm fast-xml-parser is 78.0% likely to have a medium risk anomaly
Notes: This module implements a Transform stream that accumulates all incoming data chunks into an in-memory buffer using a specified encoding (default utf8) and emits a ‘complete’ event (or callback) with the full contents when the stream ends. While functionally benign, unbounded buffering of large streams can result in high memory consumption, causing performance degradation or out-of-memory errors in resource-constrained environments.
Confidence: 0.78
Severity: 0.60
From: ? → npm/@react-native-community/cli-platform-android@20.0.0 → npm/@react-native-community/cli-platform-ios@20.0.0 → npm/@react-native-community/cli@20.0.0 → npm/fast-xml-parser@4.5.7
ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
|
