.editorconfig

.git

COMMIT_EDITMSG

FETCH_HEAD

HEAD

ORIG_HEAD

config

description

hooks

applypatch-msg.sample

commit-msg.sample

fsmonitor-watchman.sample

post-update.sample

pre-applypatch.sample

pre-commit.sample

pre-commit.x

pre-merge-commit.sample

pre-push.sample

pre-rebase.sample

pre-receive.sample

prepare-commit-msg.sample

update.sample

index

info

exclude

logs

refs

heads

develop

main

remotes

origin

objects

0a5a7a7ae166685b2937aa52090636f28a3285

34fdc9373a820cf8dfef288b265acc91376825

069fb05c7d2af7769479e6caa9e6f5a75afb87

1bde05d47f0727fc1c5d94a47106b5e02b0ec9

1f581254f4941edd45ade6dccf72830de11b97

575b24547beaabf82e98e0af4c834d488de593

e4f3c0327555950c50b69d57ab255876ca766e

04c309e199e3fbc681fb484f8c28361cc8df36

3a9a758d195295f7142bd1832ca6eb4428466b

49d39c1b94383d6b42d325d9f8a0d909f4be3d

f704a609c6fd0dbfdac63466a7d7c958b5cbf3

ea722425f3ec4fc5a6f25eab4d94b97dcc250e

aef99fd6f49c615657c3b64476e2f212779b32

f4ca1e198d14b654c4befca8041f1f8aa98911

bd9bca4c12db11cd95b2cadd7d00f8b0d43afd

1b8177a69f6d6ef0c373e492e8b810cf826f62

83b7d699c9bc6460b97d96b7d94921858ff7e6

00d1e5555102baacdd05ff612cbe35b6250351

d45f24fcbaa0b12e37bf907f4af50bed401a2a

600e713f6566a4960126e6de139d67d88d7279

34c429fbf8c0249ddd6225a58616efc50c4b5b

73519e9a144d51ef8f779641199b9e6f021e28

777fec26664b56529d80c310a4276a7052397e

3c32cac4bdc150592e3b924699341d0f4339d2

5ac814c723ae340f9323c5cb3ad164be35e712

718711ff290b4cadcab8a6f09667b1f44371aa

de2d50b28e90cdc8c2928cb577bab2b29c4ae1

44da08846eaa651f1b0831350582f86da6f1ce

7b7f1351c87d9758c503dea2925f225d26402c

99d449d597e13c75bcab7284e0b63eaf651d26

1d4aec7cd3cac0429ad2f644290a8e010f16f8

75ddbded603b7b062129237eacf562f1d125db

7b673bc9b17b59482ebde723e6b3e515a76b1f

e0ab956fa7c42edfbbffe04b6f663bfd5e5af8

f46c3bb4e704069a809faa5c92fa37d298db19

08c804c75e061b5a14c0a44dd422c7c1467b3e

1107a7a23e185709beba795c61a0214147fa3b

1e989d62aafefa1796a81e8e093ff89e0d322a

cc06e0af9e1c7fade1af0ba01d819cfba4a757

17b04e847888e4cc32b37a085594ae12e4fe8e

1a90762cff46ae5d67cd91453eb1176ada68cc

6e872aa319e30643e9f664ce85acfc78a8d1d0

f91115f9fbf0a4c98dfb0e3ba3c2e31b49f708

f9588bf182d7998d70c408669d356fe7f05cba

23245fdaed8618ef6233a639b4b4793f1e848e

4206ef561514394a51fbfa8d81e768f5312172

6b61df4dcf666303db00bde4e504fc62bffd5e

See how Anthropic automated 95% of dependency reviews with Socket

css-chain-test

suns

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

Package has an invalid manifest file and can cause installation problems if you try to use it.

What is an invalid manifest file?

Invalid manifest file

Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.

css-chain-test - npm Package File explorer