00f7ccb4047f61e0b7b0.ttf

071bf409ac27697577b3.svg

08759bda97b52f595e98.woff

0babea63c71c2f716a83.woff2

0c3174a883da84b248b3.gif

12d9e6ce264ba788abf2.woff2

1368d18f624f7ead4e81.eot

15a104a3e32d66a9e82b.ttf

17950a2a63149e34d687.woff

17ebf20f6e5535af6287.eot

19bc31febdd0577fa185.woff

1b2c83313a7bf49e0f3d.eot

1c0622c76c9bdf1ff9a3.woff

1d876c9791c9e53553de.svg

1e4745a07993c62560c0.ttf

1e59d2330b4c6deb84b3.ttf

2081ccc3ace4a3d42844.woff2

20fd1704ea223900efa9.woff2

211708fd7660b8dc1311.woff

2286035de2e5333b4b51.ttf

2a64d7c90480958a05ac.woff

2e24c06969e3ec80c7ad.woff2

3306427311f302ee74ab.svg

4243a0adf8b330027446.woff

439a0b70fe61acfe71ac.svg

473e9161869ef6c96a0f.svg

47e047477668d9ba98af.ttf

4bb9f9799f8775c1f240.woff

4fbfe7900e394108c8ec.ttf

56df831e3caf35cfe8a5.svg

585fba7fbb255b1e76dc.ttf

5a6f596f4a18e728b6f3.woff2

604d0d263f9605bfbe80.eot

62f886203d1b9444300e.woff

6592555a2bf6b275e1df.woff

6836d4f9345400a6f30b.woff

6a1189f9d19e9bfc19b7.svg

6aa0c52f188dc4b825d0.gif

6aea3d7021cd003a3b4e.woff2

6c12da9dd092426ab84f.ttf

6c4ff0cce9864bbfae5f.eot

6d004f1d10ccd00df55e.woff

6d4cb2e2edcf03748d67.woff

749973ba090f02a3c9bb.png

7504d90e1ba705e20faf.ttf

751d6cbe0875ae97dc1c.svg

76c0271d358c98a3eadd.ttf

791b5e3dfa5b36eb537a.woff2

792ac079a117733863fc.ttf

7bc9ce404c297c24f210.otf

7bd16104e6ff139ba069.woff2

7c702ee3a0388bcd5fe5.woff

7e101da62790bb545eea.woff

7f01b07148f205f6e825.png

7fb79b129b1d57c4eca4.ttf

84b8d728eb1f047ab9cf.woff

8b43027f47b20503057d.eot

91120d59ac3dce81d2b0.woff2

9223b3999f78ce89d48c.ttf

9490dc43e0b21c40cc09.ttf

949e826c979149099dcb.woff

95849a8856e5e4f4a22d.woff2

95e3a6d0a54b2a15dcea.woff

9a41aed96661cfc2f960.eot

9b753eb78f7859f8acc4.ttf

a00b8912ae4f9345d098.woff2

a1784ef624a7ad307acb.eot

ad846a35cca833cd1485.eot

afc5ac16dc1e359ece81.woff2

agorafont.css

agorafont.css.map

agorafont.js

agorafont.js.map

areamap.css

areamap.css.map

areamap.js

areamap.js.map

aspfont.css

aspfont.css.map

aspfont.js

aspfont.js.map

b231b62df6ad72b806a6.png

b5228f8243ecb22590e2.eot

b723b56d54797c3baf49.eot

b724f6c6daa6c53c630b.svg

b825a3eef0737eb07489.ttf

b9cdb6ca5a78a2ebea59.woff2

ba839c214967da158ef1.woff

ba9160d9786f3ba55d1a.eot

bc07fa358cc8196b46af.woff

bc411a2f06e97616232a.svg

bd350a81317ef9e9037d.svg

ccecd696c5667fb48d89.eot

cd9815a42147188f8aa8.woff

customfont.css

customfont.css.map

customfont.js

customfont.js.map

d0c9c86083b8510fb48d.woff2

d36d4649a76539dc110b.woff

See how Anthropic automated 95% of dependency reviews with Socket

ibp-cdn

idcglobal

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

ibp-cdn - npm Package File explorer