.changelog

github

content-v2

sha512

68076c6e161bdcf24a2ef85bb5c9b8df6838f7a9ef6175ce7881a2a97135a248d734673256b9b87072d6f7cf191166cfa5404550b96788da76c99e0f03ff

feda94b1406132f504fd3fdaa4631c701398567c6b6e650c2deef14d152cd21b9994960865889b3a0ab8c90931de22d4c9b335e26ee1b75aa5f63be8f511

b49a2cfdb45dbdfa603358ff6fc581c58f87d25c57739f27b3e1c2ec666bc31af32b6d4608bd7a09ff2d9bec4285439166b14b0b2eb8f0cba84e4b7da815

df36d06fe0f281af7d29d71804fc83dda37d42c5e50f0439f51766a1496570e10d1360020e5bd8a9776344db852599c14ed2f3f0aec863aa9329c22e79d0

796e68028781b669dbdc7fac4aaab334151479d1823980a1dcd7822ebe37ab90d0f51542251aa66b2711da8e8a824778b280b9af0df17eba35351b886f28

de0cd99d7c39d192f7f64c98b2fbce3bbb46cb1e45094816438809d438af6d7d0f2ab3f8bf77e7095bd259abb8a7cfc84c74a716a20a87146147dae780ad

42845aec03befac6335dc96d07c6fbf1e2ae70a3864ae6e55571583b67bdabaf111418b808a2a478ed532ee740b5b94993bd18a42bd541298ce1667fe1b9

270d882742f5a10cf64a2be3187f39f2f633d11d72807aa3fc40225a11090a5903179187f74c91fe5f59efe2c4a294dafc66f36f85ffe83e2213cc6819ae

d0381653dc4678d95d20d1d5f68c94a1eae9fe4173303775ce3dc0f67c078cdbc0098cc11347332c6929b5fd527a7edd22f6b51b07aa53486f7334f7b7c9

b70a39b9d96ed33e1aa0a581ab5c88b9240a05a7b6a13f2f20b4c353781dcd8a203aaa8af7d0ef5edbfd9ec5e33bda3ef53985cacb67fa79a8b174470220

40fc97eb62016664987f0fe2942e034999300a494f6956bf39b0660a66db9831504b3a56a3e95f6bc06b20ce4a9c454af38793ded43616d9ae281eb5f4e0

2c75dd4b536018c76593ac8de2b90d3bef7b836dd985e8ead3dfc3c7ead70cffd425437ae3d95c507446e38cd9a8183e2dfc231ae7435a9e0e5dfe55ff3c

08b6ecfa877e8925e6a38a583f365f755028c5177eb5a7b790022b80e709c70db7271549a2677094fbce473b8d3d71896511777e9f787b38d5e7697e0edb

21ba1be52318e366c4e8b6bfc4f461b50f27b226c8aaa27631fb008633716d259a9e19d45e7d5488c004066b2419fb8a1b275a15276e3302edf84d234cbe

672aabe2107c95481dd2ea2c168d706233b1b9e42f8cee5aa89bad5c6633e7008c5263f5878c56bf4ca4ae7c42d235a3ad865ac3c6768a6166ba62a4260a

e1889bb9402f4f2b5908042bd2ed74374205856910b106e26722fb0e24afc98df8fb614f39bf7a371380a2536b16b74d335308da7bd11519a480011e5d0d

3f923cdb5ed4d5a4c4f2f946eaff8e17dce33654e78ba3889a3a5c551f92874625fdbf1d6872ae00958e8eb6ca1e1400728036b16528c31c6910f6a86d75

e106a2ec6b3a84f0ca43aa05a9b618704cb00007fcca0c45d165f782c5b814a57d7bf2b86dba2ec55bda7566403434a6773ddd0e1852227d9b5e2a8c57c7

896391443c3a4a54d4cfad9e1afbe0e5ab037cd6540564e732ff872ad3323f3dbc1cd38446238b332af7a3e6debf7c76492fa034b574b77f64cd81cd2c71

5173be29b8986015e1d3f7616b158aca43a440a5b0019a4513d5ab0a8e1359915c6666a38c164175e36bd679a29f8648ebba292567f173757307c730448e

a720f94980f4574069c646b2726f7c401cf3dc6e2a319deaadd104c619d03c57a12976d05f9278ddcae34d2818c7c77428f317e58d6245262ce898b37fe3

7402489cd8f875f00efa3ca49c6207d0944fd79e0d14623319dc40e84f8eea5d898a75b5bf0e81062ef2585bafd99f323601a0abfcb2d7f62a300675b735

3985f46999024e71736f2428ae60a4ff0d859e8214921586600a0df9994a17edda302064513acf1d860dbac75c75cc101b2f342731f071c1a1bc5cf30790

d2cddeb574399ee96ddd2cc4c2cbf3b20f1a305e46bfe06eea0d4c40fafc9da202419c8ab5a18ef9efea6c9ffcab1540b42c9302695fe26d08e62f5e03d0

c6f2c1fabb79fe1e0aadd8aa104d8935f6fba24fc7af49b6d4e027f0eb942bc609a0cac332e9279d751984851c4061d7f9ff8528356bc29440d1e2436af6

34635e8419f09571fa1d694c846ed3ecde743b220d9d213500412fb593d6f800bb30225286d2a450a0c1a67232c56aa3b35ce7e61ed579dea164882b33b4

7036c249080a25c7203d2b47428ed90885644c10ea6363c55c8ea7d0c463e520faba641712bfa9423e107cf2316665f1d42a940465e260957ae950e676d7

8a4f2be9d45105794a28fb872e7b33bbc951f85f9d4a52628a3318d14d5f99e2c31044e853631efb990ddd5713a62828ba9b746b6438692b127dfa67789c

8151c30abb406e6e0e9aa762061346428b92ca27d301a0799c2993361d0bdf813c46af470955613727126651a634300075459d4c735320215650b29ee003

df19deba30f1cb05526a76faf53934cf6f7fcf791eeeb597d3a62f2f02954183dbe414e3bd24e047ac8a4f635a22382375410af863e92f7d9be39f62bedb

7ff614eb3b7447293b8d412ce22c188fccc735996a9928d20f83fc4d8aa5e47a38e0be6009511512da61cee97081a638bb6024c0bd58b264b08a3f9612f3

a5ed9ae39d519cada00cd4021548800826b4998b1f16519a87128e8f2c9ce509f746a7213403f5ec1908f19043a4f3682d1fe62a7f8f6791ca1adff9dca6

a28af58f35285797c208399ea8eea1f432563ea77652dfb6db1ad07612163941abfe0ae67d090d1ee5c60ecfe7ccf0d9d60e0aeee99b9f3fc714f23fb618

6a4bd6c341bbde10140ce3f6c330ec188d380e192b498caa83857df90cd6f0bc295c2b0a34524e151303fc676db5e305227feb7ee420e8948c377e912625

3e8748745ac9edde77f55f8669165ccad18565f464616369db0a34a4dfc5eacb2470f60ea8862acfc467f533c1c4ab79a5c016b7312f88e79891b05eae49

Addon to help standardize the ember family of websites. 

See how Anthropic automated 95% of dependency reviews with Socket

ember-styleguide

Addon to help standardize the ember family of websites

real_ate

jenweber

locks

amyrlam

melsumner

sivakumar-kailasam

acorncom

tjordan

jaredgalanis

minthamie

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

Package has an invalid manifest file and can cause installation problems if you try to use it.

What is an invalid manifest file?

Invalid manifest file

Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.

What are invisible characters?

Invisible chars

(Experimental) Package license has recently changed.

What is a license change?

License change

(Experimental) Contains an SPDX license exception.

What is a license exception?

License exception

This package is not allowed per your license policy. Review the package's license to ensure compliance.

What is a license policy violation?

License Policy Violation

Contains long string literals, which may be a sign of obfuscated or packed code.

What's wrong with long strings?

Long strings

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

What is a major refactor?

Major refactor

This package is malware. We have asked the package registry to remove it.

What is known malware?

Known malware

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

What is manifest confusion?

Manifest confusion

Contains a medium severity Common Vulnerability and Exposure (CVE).

What is a medium CVE?

Medium CVE

Contains a low severity Common Vulnerability and Exposure (CVE).

What is a mild CVE?

Low CVE

This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.

What's wrong with minified code?

Minified code

(Experimental) A package's licensing information has fine-grained problems.

Misc. License Issues

The package was published by an npm account that no longer exists.

What is a non-existent author?

Non-existent author

A required dependency is not declared in package.json and may prevent the package from working.

ember-styleguide - npm Package File explorer