.cache

6fc40119c7969d758ab027c5887ff5.json

9a24b0b53251bb9edcb0b322ec9225.json

000f3dda5246cde5b18e6cf0ec325d11.json

003e5509174e99b60709ab6ad4560112.json

1b7f02ea78eb75e41c2d73cb0fff9d.json

2f32ab11c41681f91ccf1fb7b082a4.json

ef0f9c85f1f76cc2911b1b1510aadf.json

5862d4e2e18486b48cd7748a54b925.json

29ed528ddcd389dda6d43ab628313c.json

a7709b6b3059c65d5623507651ebe1.json

286b32319cec516a5620ab58bec2e3.json

5bbf9d52ef3e92e36fb6698ced96cd.json

066b4c5456693ecd5d3c4773df9c9a1d.json

06c338675b377efe30976a73eb2fcec7.json

084ea9f8f8710e1a109d175cb528e32d.json

086e498b3256d9dbac13f752d889b816.json

8a8b3a274a97213c2af5ac8fe7b216.json

9b52f6147f810c92384cdd633bc19e.json

e9413be260dad7f46e1d8e4cf248d1.json

094e413c8e12a8c91f92f0fa75843629.json

09e4e39bc4d61521d9e6a7e68d5e97a1.json

849f209548f911505f91d0ba5410ab.json

a9371561800b037cd7c8578bc9de70.json

0a6431966e108655811828809bf883dd.json

0ac669184c3d3b8530a3fb63d31f4f36.json

5896ea4aed9c4a62604a13a692328c.json

facbb473a024c42987c9b21b1e91cf.json

0b0c683bf8883d70119835d167fc210f.json

5bc0416c32f2dff4704675a588b557.json

0cd10daa64150631ebc8fe8a66e9f810.json

60fd33f9bbc6e695b6d408d6c4ca50.json

a3d162a83faa2fcd3a09c0b3763247.json

ab7bafc8eca6e00dd19450cb977ea8.json

0e1574aedf015d267aef4170de674c9d.json

0eaf2870a0c6311ce0ba11f5055f77a6.json

657fb8581844879441852a69ce0b46.json

09779e5f52da05caebe79fd70b4403.json

1168ab54bd5702d4b257f74c6d26280b.json

fecb6220c68a1854e2c73fa227fac4.json

7b67e283e7b2fae0827c9af2516b4a.json

13fb2c2266ca649b63dc54deb4f3d1b9.json

3658168095e4dcfd87e8f07f06515e.json

b539d915a6d377ecdc6d4aa1a78560.json

16d5726fcec24323036252f7a9588775.json

17a4dcd2393e289d0cfbe5efaa8d0dac.json

17d363e96e0b934cd07d47397c09083f.json

17dfa9aa8d6544c87373377970b11e00.json

1df8b81f8b82f0c3195a06a0ef9ab7.json

5e5e9d3b8f0e39f8ccafa805f30d0b.json

ac1e01704c060b40909cb562e7059d.json

1a8564a0187c7f5f294022ce585844f2.json

169b3760c52fc92c7c012f060e5d45.json

1ce1bc2374d3a39dc4bd2bd8ec7de573.json

1ce266df798d603eacfcccb836e1f61f.json

15127c1749e43acb5a9c23cd9f8c2b.json

2b3d200a982a5e4dceecfadd38b54d.json

1bb2f6957fcad1e5d2ab7f8456c14c.json

202dbe552c5a8661abd973652e8ae280.json

0deb540b2d045dfd06772839bcaa65.json

58b22b0957a77048f9de9fb3b898e6.json

21163655c927e2b4bbdc78dced899d78.json

2148614aea4be60d024c3cd3234bd3bc.json

2245b3f6ac6e083f16d6b2d37c070a40.json

09fcdf329e83ff681e557217efae37.json

240faae0ceab495edaaf6716f17d870a.json

24e2a0316d507c047706a3e1bfd5f51c.json

884b9b0dfb8995f827061ddb95e556.json

25848dec78d809c389325818363b36ab.json

25a8f687f4b90284bde6d01fb8a9b1a8.json

26f2e6d4bb41489468a658f13d318523.json

949580bffdd55ba30c12eb3bff4c3e.json

See how Anthropic automated 95% of dependency reviews with Socket

@atjson/offset-inspector

bbui

blaine

offset-inspector

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

Package has an invalid manifest file and can cause installation problems if you try to use it.

What is an invalid manifest file?

Invalid manifest file

Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.

What are invisible characters?

Invisible chars

(Experimental) Package license has recently changed.

What is a license change?

License change

(Experimental) Contains an SPDX license exception.

What is a license exception?

License exception

This package is not allowed per your license policy. Review the package's license to ensure compliance.

What is a license policy violation?

License Policy Violation

Contains long string literals, which may be a sign of obfuscated or packed code.

@atjson/offset-inspector - npm Package File explorer