.cache

6fc40119c7969d758ab027c5887ff5.json

9a24b0b53251bb9edcb0b322ec9225.json

000f3dda5246cde5b18e6cf0ec325d11.json

003e5509174e99b60709ab6ad4560112.json

2f32ab11c41681f91ccf1fb7b082a4.json

5862d4e2e18486b48cd7748a54b925.json

066b4c5456693ecd5d3c4773df9c9a1d.json

06c338675b377efe30976a73eb2fcec7.json

084ea9f8f8710e1a109d175cb528e32d.json

086e498b3256d9dbac13f752d889b816.json

9b52f6147f810c92384cdd633bc19e.json

094e413c8e12a8c91f92f0fa75843629.json

09e4e39bc4d61521d9e6a7e68d5e97a1.json

0a6431966e108655811828809bf883dd.json

0ac669184c3d3b8530a3fb63d31f4f36.json

5896ea4aed9c4a62604a13a692328c.json

0b0c683bf8883d70119835d167fc210f.json

0cd10daa64150631ebc8fe8a66e9f810.json

a3d162a83faa2fcd3a09c0b3763247.json

0e1574aedf015d267aef4170de674c9d.json

0eaf2870a0c6311ce0ba11f5055f77a6.json

657fb8581844879441852a69ce0b46.json

09779e5f52da05caebe79fd70b4403.json

1168ab54bd5702d4b257f74c6d26280b.json

7b67e283e7b2fae0827c9af2516b4a.json

13fb2c2266ca649b63dc54deb4f3d1b9.json

3658168095e4dcfd87e8f07f06515e.json

b539d915a6d377ecdc6d4aa1a78560.json

16d5726fcec24323036252f7a9588775.json

17a4dcd2393e289d0cfbe5efaa8d0dac.json

17d363e96e0b934cd07d47397c09083f.json

17dfa9aa8d6544c87373377970b11e00.json

5e5e9d3b8f0e39f8ccafa805f30d0b.json

ac1e01704c060b40909cb562e7059d.json

1a8564a0187c7f5f294022ce585844f2.json

1ce1bc2374d3a39dc4bd2bd8ec7de573.json

1ce266df798d603eacfcccb836e1f61f.json

202dbe552c5a8661abd973652e8ae280.json

0deb540b2d045dfd06772839bcaa65.json

58b22b0957a77048f9de9fb3b898e6.json

21163655c927e2b4bbdc78dced899d78.json

2148614aea4be60d024c3cd3234bd3bc.json

2245b3f6ac6e083f16d6b2d37c070a40.json

09fcdf329e83ff681e557217efae37.json

240faae0ceab495edaaf6716f17d870a.json

24e2a0316d507c047706a3e1bfd5f51c.json

884b9b0dfb8995f827061ddb95e556.json

25848dec78d809c389325818363b36ab.json

26f2e6d4bb41489468a658f13d318523.json

949580bffdd55ba30c12eb3bff4c3e.json

08201330217fa19339a60042086dc7.json

286e2ee910c1c6b9e12e5cf72943ce18.json

289ba38b7e08d2eda576018518f2d921.json

28ab0e90f08c7e123474e210ecca8bbb.json

298190f7c1cc12915d7147443880a0d9.json

c03ee41f0496c768e5421b330471fd.json

2c9b1be5f854c7ea22f09c89dd0db742.json

2d7efa208096d814fc29b9587ae9f277.json

239780ccc2ff1e9efdc4b88b3b7e23.json

2e101a6afb5c22e357aef87472dbb826.json

2efc8f8174c7f76937d3bb0df19b47ab.json

301d6a2dbd0d8c8d24e472ff8fd029fe.json

3254344c67e096bb8526c58568fbeb26.json

38f053c420b7a8f84496d5b4786c3b.json

353c45840ad5eb5a350421ceb0d617b0.json

362dcf9d622d1a7489961a6bc1fc72bd.json

ed4b43ee494b00a4b25d141c69413f.json

379185ef0c1b083071acddf71c644bfd.json

38083b6080aa1db5fc028509dd4011b1.json

38437157375264b504fe7a17050a5e74.json

0337d76b0b87bfe30a1f9c33b5debd.json

3b023fa9dadf501a7f2b75fd95f3343a.json

3c2027bc161803dba78ebf7707c2279d.json

3c7758b32e13eb22c81def2ce4a32f5e.json

a76278765078877a91b0923a133409.json

3d53ef0b707d054d5f18ba9a9b0275d1.json

See how Anthropic automated 95% of dependency reviews with Socket

@atjson/offset-inspector

bbui

blaine

offset-inspector

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

Package has an invalid manifest file and can cause installation problems if you try to use it.

What is an invalid manifest file?

Invalid manifest file

Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.

What are invisible characters?

Invisible chars

(Experimental) Package license has recently changed.

What is a license change?

License change

(Experimental) Contains an SPDX license exception.

What is a license exception?

License exception

This package is not allowed per your license policy. Review the package's license to ensure compliance.

@atjson/offset-inspector - npm Package File explorer