Package evidence

@socketsecurity/[email protected]

Credential file access: matched ".npmrc"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,288Niche · −30% score
Versions published: 415Mature · −50% score
First published: Feb 2025
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@socketsecurity/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@socketsecurity/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes4,951,870

Previous version1.1.118

Published2026-06-11T07:09:42.854Z

SHA-256e44c152042fbd613eb7b8d37d40ddcd928a7598e0049edaac70ad768518ec1a1

Why flagged

What the scanner saw

Credential file access: matched ".npmrc"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

6d agoLast checked

reviewRisk

1Score

1.1.119Version

Status history (1 event)

new → available6d ago · risk review · score 1 · status changed

Evidence

Static findings

10 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 10 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/external/@socketsecurity/registry/lib/globs.js	matched ".npmrc"	5
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/confirm.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/input.js	high encoded/escaped-token density	0
low	Large Javascript Payload	package/external/@socketsecurity/registry/external/libnpmpack.js	3408939 bytes	0
low	Large Javascript Payload	package/external/@socketsecurity/registry/external/pacote.js	2363104 bytes	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/password.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/search.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/@socketsecurity/registry/external/@inquirer/select.js	high encoded/escaped-token density	0
low	Obfuscation Density	package/external/blessed/lib/unicode.js	high encoded/escaped-token density	0
low	Large Javascript Payload	package/dist/vendor.js	5213726 bytes	0

Manifest

Package metadata

Scripts52

//lint:dist:fix:eslintdotenvx -q run -f .env.dist -- eslint --report-unused-disable-directives --quiet --fix ./dist | dev-null
//lint:external:fix:eslintdotenvx -q run -f .env.external -- eslint --report-unused-disable-directives --quiet --fix ./external | dev-null
bsdotenvx -q run -f .env.local -- pnpm build:dist:src; pnpm exec socket --
buildpnpm build:dist
build:distpnpm build:dist:src && pnpm build:dist:types
build:dist:srcrun-p -c clean:dist clean:external && dotenvx -q run -f .env.local -- rollup -c .config/rollup.dist.config.mjs
build:dist:typespnpm clean:dist:types && tsgo --project tsconfig.dts.json
build:seanode src/sea/build-sea.mts
build:sea:internal:bootstraprollup -c .config/rollup.sea.config.mjs
checkpnpm check:lint && pnpm check:tsc
check-cipnpm check:lint
check:lintdotenvx -q run -f .env.local -- eslint --report-unused-disable-directives .
check:tsctsgo
cleanrun-p -c --aggregate-output clean:*
clean:cachedel-cli '**/.cache'
clean:distdel-cli 'dist'
clean:dist:typesdel-cli 'dist/types'
clean:externaldel-cli 'external'
clean:node_modulesdel-cli '**/node_modules'
coveragerun-s coverage:*
coverage:testrun-s test:prepare test:unit:coverage
coverage:typedotenvx -q run -f .env.local -- type-coverage --detail
e2e-testsdotenvx -q run -f .env.test -- vitest run --config vitest.e2e.config.mts
fixpnpm lint:fix
knip:dependenciesknip --dependencies
knip:exportsknip --include exports,duplicates
lintdotenvx -q run -f .env.local -- oxlint -c=.oxlintrc.json --ignore-path=.oxlintignore --tsconfig=tsconfig.json .
lint-stageddotenvx -q run -f .env.local -- lint-staged
lint:dist:fixrun-s -c lint:dist:fix:*
lint:dist:fix:biomedotenvx -q run -f .env.dist -- biome format --log-level=none --fix ./dist | dev-null
…and 22 more.

Dependencies2

@sentry/node10.57.0
@socketsecurity/socket-patch2.0.0