darknode-cli
Advanced tools
darknode-cli - npm Package Compare versions
New alerts
Known malware
Supply chain riskThis package version is identified as malware. It has been flagged either by Socket's AI scanner and confirmed by our threat research team, or is listed as malicious in security databases and other sources.
Explicitly Unlicensed Item
LicenseSomething was found which is explicitly marked as unlicensed.
Install scripts
Supply chain riskInstall scripts are run when the package is installed or built. Malicious packages often use scripts that run automatically to execute payloads or fetch additional code.
Misc. License Issues
LicenseA package's licensing information has fine-grained problems.
Network access
Supply chain riskThis module accesses the network.
Found 6 instances
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Unpublished package
Supply chain riskPackage version was not found on the registry. It may exist on a different registry and need to be configured to pull from that registry.
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 59 instances
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Found 6 instances
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Unidentified License
LicenseSomething that seems like a license was found, but its contents could not be matched with a known license.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Fixed alerts
Empty package
Supply chain riskPackage does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.
Unpopular package
QualityThis package is not very popular.
No contributors or author data
MaintenancePackage does not specify a list of contributors or an author in package.json.
No License Found
LicenseLicense information could not be found.
No tests
QualityPackage does not have any tests. This is a strong signal of a poorly maintained or low quality package.
No v1
QualityPackage is not semver >=1. This means it is not stable and does not support ^ ranges.
Improved metrics
- Total package byte prevSize
4609037
1379851.2%- Number of package files
135
6650%- Lines of code
81231
Infinity%- Number of low maintenance alerts
1
-50%- Number of low quality alerts
1
-66.67%- Number of medium quality alerts
0
-100%- Number of lines in readme file
110
2650%Worsened metrics
- Number of high license alerts
1
Infinity%- Number of medium license alerts
1
Infinity%- License quality
0
-100%- Number of critical supply chain risk alerts
1
Infinity%- Number of high supply chain risk alerts
1
Infinity%- Number of low supply chain risk alerts
292
29100%- Number of medium supply chain risk alerts
93
9200%