.git

COMMIT_EDITMSG

HEAD

config

description

hooks

applypatch-msg.sample

commit-msg.sample

fsmonitor-watchman.sample

post-update.sample

pre-applypatch.sample

pre-commit.sample

pre-push.sample

pre-rebase.sample

pre-receive.sample

prepare-commit-msg.sample

update.sample

index

info

exclude

logs

refs

heads

master

remotes

origin

objects

8b93a8dbed86c57c9637806e1bda4cbcb862c0

d0c0bd64dc6fc034423838483d15492f63efbb

459588733db93346db8185bbab54c40b6420b5

7b43fea035dc90ab11112affb57380e1358ead

852d1ca5ece3d724d9385218d847966cebfaa9

a06107a9378172b476e0ade0a7380340016d90

df9d2479d38e71cafa01ff6ccf8ab5c39fa367

40edd9a8b3e876d9dbfc90164905b89e6d733f

f162bcdf1c7c56d4e5a1534193fe60582ae8c5

908e6cb6fce348a5b0a0aebf609bdf82a83dbe

739348baed9eda6d5fe57cf9182e2c546e18c9

81c3a8104a34403263ebd9a4ec8bac484f9877

83092adc2112cf7c0a863984cba4e80b4705be

f3a8b80cd218a35ef7b9c8ac4a0c7594527eeb

00275369eedcac5a9c60b542a03e6c6854733d

a3acfa138db01dc50a688796b2861638c369ec

df724006471275989094e150cb9a247f52502f

c046bde3eff9585f6a5e0386a1e14b8e83e444

ea5b64755e2d2449faa0320f3abac738672741

23b8b81518e68508862d23d258778a4632fa73

38e6798511ed3a12836448d9d554020ec38d35

81b196e4f8d60209516803f7cf9a64ff3c929a

98bf3b0b7668591a6d67f8931125d6a94ba8f0

9c9c11238e4908e66326beb909816b971c76ac

e039c3bfd6de2d4e003566dc53c711eee39a55

0793fa07858d9bbfbf7daea1a356d14dfebf34

39f385c798723dc0234c1ff0d387d676942e92

7f2a0f204f0db142d5fd73bad9c81b733360c5

838254c8bf69b50a759d8323dc873f838f66cd

3c206ec5f905d861d9ca16113599c22f0fa691

72d7db40a5772d3e693c4434614ce0d0a47352

94975a82be383f4c712e2aec1ce47b5b7c6f4c

368f31f0f8dc49771159ca67f23939926ce557

b13ca367e929eeed381ae06593fa168829149e

d1a6b83cd4e177754a9fc69b4d44687897e3a8

1166052a6a6260a00cdf278aeb92998437d029

644fa77168a4b3582c7846faf65c2ecbf2c20e

90c88bb2f0ee0740c64d1ce020af018175b7ad

233bdb75fb24c996e11d925c8972c432cb3194

2464bf22b4244f5f1f5fcf1d502a1521ea1615

d205203391c60aa98529ad545a63c4a53e7f23

aa2dd5007294bbeb69e6cbac01dcc6d7842d88

c3a74a6d98a15abb6f8bfcf0b2b19095bdd6c3

5687c3623b32aac410a59b51633b81fb8ea863

5b933a007287bf2cf3fbdd11d35e69a13dcda2

5ec3105c2b264d53804cbe966466a82892705d

91bf55d0a6523b3a5c2c1bb9531d4f9fd7479f

d675d96fb3691399e32e61dc4531f6d888afbd

f79e082d4582f618d73eda5e686f8584105f2a

See how Anthropic automated 95% of dependency reviews with Socket

asn1-ts

ASN.1 encoding and decoding, including BER, CER, and DER.

jonathanwilbur

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

Package has an invalid manifest file and can cause installation problems if you try to use it.

What is an invalid manifest file?

Invalid manifest file

Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.

What are invisible characters?

Invisible chars

(Experimental) Package license has recently changed.

What is a license change?

License change

(Experimental) Contains an SPDX license exception.

What is a license exception?

License exception

This package is not allowed per your license policy. Review the package's license to ensure compliance.

asn1-ts - npm Package File explorer