Socket
Socket
Sign inDemoInstall

ses

Package Overview
Dependencies
Maintainers
6
Versions
103
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

ses - npm Package Compare versions

Comparing version 0.17.0 to 0.18.0

19

CHANGELOG.md

@@ -6,2 +6,21 @@ # Change Log

## [0.18.0](https://github.com/endojs/endo/compare/ses@0.17.0...ses@0.18.0) (2022-11-14)
### ⚠ BREAKING CHANGES
* **ses:** Remove support for globalLexicals
### Features
* **ses:** Remove support for globalLexicals ([3b90d5d](https://github.com/endojs/endo/commit/3b90d5d96984ff211efe5e47de1ce57cde7be980)), closes [#904](https://github.com/endojs/endo/issues/904)
### Bug Fixes
* assert touchups ([#1350](https://github.com/endojs/endo/issues/1350)) ([3fcb5b1](https://github.com/endojs/endo/commit/3fcb5b117eccb326c6c81339ae6a293a6bcaa9d4))
* fail template ([#1334](https://github.com/endojs/endo/issues/1334)) ([725b987](https://github.com/endojs/endo/commit/725b987ffa812a070ff45fcd496cf8fd88df6963))
## [0.17.0](https://github.com/endojs/endo/compare/ses@0.16.0...ses@0.17.0) (2022-10-24)

@@ -8,0 +27,0 @@

2

index.d.ts

@@ -92,3 +92,2 @@ /**

transforms?: Array<Transform>;
globalLexicals?: Record<string, any>;
moduleMapHook?: ModuleMapHook;

@@ -200,2 +199,3 @@ importHook?: ImportHook;

): DetailsToken;
Fail(template: TemplateStringsArray | string[], ...args: any): never;
quote(payload: any, spaces?: string | number): ToStringable;

@@ -202,0 +202,0 @@ makeAssert: MakeAssert;

10

NEWS.md
User-visible changes in SES:
# v0.18.0 (2022-11-14)
- *BREAKING*: Removes support for `globalLexicals`.
To our knowledge, there are no production uses for `globalLexicals`.
They currently could leak because `moduleLexicals` and `globalLexicals`
used the same scope object, so properties of one would leak to the other
with crafted modules.
We had an opportunity to plug the leak at the cost of a fifth scope
in all evaluators, but elected to remove the unnecessary complexity instead.
# v0.17.0 (2022-10-24)

@@ -4,0 +14,0 @@

12

package.json
{
"name": "ses",
"version": "0.17.0",
"version": "0.18.0",
"description": "Hardened JavaScript for Fearless Cooperation",

@@ -62,5 +62,5 @@ "keywords": [

"devDependencies": {
"@endo/compartment-mapper": "^0.7.15",
"@endo/compartment-mapper": "^0.8.0",
"@endo/eslint-config": "^0.5.1",
"@endo/static-module-record": "^0.7.14",
"@endo/static-module-record": "^0.7.15",
"@endo/test262-runner": "^0.1.28",

@@ -79,4 +79,4 @@ "ava": "^3.12.1",

"terser": "^4.8.0",
"tsd": "^0.19.1",
"typescript": "~4.6.2"
"tsd": "^0.24.1",
"typescript": "~4.8.4"
},

@@ -184,3 +184,3 @@ "files": [

},
"gitHead": "8fb324d8f13a0c6939dc0c1feb831f72298f1853"
"gitHead": "da16a94856482e36296b7cae16d715aa63344928"
}

9

README.md

@@ -468,4 +468,3 @@ # SES

const transforms = [addCodeCoverageInstrumentation];
const globalLexicals = { coverage };
const c = new Compartment({ console }, null, { transforms, globalLexicals });
const c = new Compartment({ console, coverage }, null, { transforms });
c.evaluate('console.log("Hello");');

@@ -507,7 +506,5 @@ ```

```js
const __shimTransforms__ = [addMetering];
const globalLexicals = { meter };
const c = new Compartment({ console }, null, {
const __shimTransforms__ = [addCoverage];
const c = new Compartment({ console, coverage }, null, {
__shimTransforms__,
globalLexicals
});

@@ -514,0 +511,0 @@ c.evaluate('console.log("Hello");');

12

src/compartment-evaluate.js

@@ -6,3 +6,2 @@ /// <reference types="ses">

create,
defineProperties,
getOwnPropertyDescriptors,

@@ -32,5 +31,5 @@ } from './commons.js';

let { globalTransforms } = compartmentFields;
const { globalObject, globalLexicals } = compartmentFields;
const { globalObject } = compartmentFields;
let localObject = globalLexicals;
let moduleLexicals;
if (__moduleShimLexicals__ !== undefined) {

@@ -47,5 +46,4 @@ // When using `evaluate` for ESM modules, as should only occur from the

localObject = create(null, getOwnPropertyDescriptors(globalLexicals));
defineProperties(
localObject,
moduleLexicals = create(
null,
getOwnPropertyDescriptors(__moduleShimLexicals__),

@@ -57,3 +55,3 @@ );

globalObject,
globalLexicals: localObject,
moduleLexicals,
globalTransforms,

@@ -60,0 +58,0 @@ sloppyGlobalsMode,

30

src/compartment-shim.js

@@ -10,9 +10,5 @@ // @ts-check

WeakMap,
arrayFilter,
arrayJoin,
assign,
defineProperties,
entries,
freeze,
getOwnPropertyNames,
promiseThen,

@@ -28,3 +24,2 @@ weakmapGet,

} from './global-object.js';
import { isValidIdentifierName } from './scope-constants.js';
import { sharedGlobalPropertyNames } from './whitelist.js';

@@ -212,3 +207,2 @@ import { load } from './module-load.js';

__shimTransforms__ = [],
globalLexicals: globalLexicalsOption = {},
resolveHook,

@@ -252,24 +246,2 @@ importHook,

const invalidNames = arrayFilter(
getOwnPropertyNames(globalLexicalsOption),
identifier => !isValidIdentifierName(identifier),
);
if (invalidNames.length) {
throw new TypeError(
`Cannot create compartment with invalid names for global lexicals: ${arrayJoin(
invalidNames,
', ',
)}; these names would not be lexically mentionable`,
);
}
// The caller continues to own the globalLexicals object they passed to
// the compartment constructor, but the compartment only respects the
// original values and they are constants in the scope of evaluated
// programs and executed modules.
// This shallow copy captures only the values of enumerable own
// properties, erasing accessors.
// The snapshot is frozen to ensure that the properties are immutable
// when transferred-by-property-descriptor onto local scope objects.
const globalLexicals = freeze({ ...globalLexicalsOption });
const globalObject = {};

@@ -288,3 +260,2 @@

globalObject,
globalLexicals,
globalTransforms,

@@ -314,3 +285,2 @@ sloppyGlobalsMode: false,

globalObject,
globalLexicals,
safeEvaluate,

@@ -317,0 +287,0 @@ resolveHook,

11

src/environment-options.js

@@ -8,3 +8,3 @@ // @ts-check

const { details: X, quote: q } = assert;
const { details: X, Fail, quote: q } = assert;

@@ -113,8 +113,5 @@ /**

typeof setting === 'string' ||
// eslint-disable-next-line @endo/no-polymorphic-call
assert.fail(
X`Environment option value ${q(
setting,
)}, if present, must be a string.`,
);
Fail`Environment option value ${q(
setting,
)}, if present, must be a string.`;
return setting;

@@ -121,0 +118,0 @@ };

4

src/error/assert.js

@@ -378,2 +378,5 @@ // Copyright (C) 2019 Agoric, under Apache License 2.0

/** @type {FailTag} */
const Fail = (template, ...args) => fail(details(template, ...args));
// Don't freeze or export `baseAssert` until we add methods.

@@ -437,2 +440,3 @@ // TODO If I change this from a `function` function to an arrow

details,
Fail,
quote,

@@ -439,0 +443,0 @@ makeAssert,

59

src/error/types.js

@@ -264,2 +264,60 @@ // @ts-check

/**
* @typedef {(template: TemplateStringsArray | string[], ...args: any) => never} FailTag
* The `Fail` tamplate tag supports replacing patterns like
* ```js
* assert(cond, X`...complaint...`);
* ```
* or
* ```js
* cond || assert.fail(X`...complaint...`);
* ```
* with patterns like
* ```js
* cond || Fail`...complaint...`;
* ```
*
* However, due to [weakness in current
* TypeScript](https://github.com/microsoft/TypeScript/issues/51426), the `||`
* patterns are not as powerful as the `assert(...)` call at enabling static
* reasoning. Of the `||`, again due to weaknesses in current TypeScript,
* the
* ```js
* cond || Fail`...complaint...`
* ```
* pattern is not as powerful as the
* ```js
* cond || assert.fail(X`...complaint...`);
* ```
* at enabling static resoning. Despite these problems, we do not want to
* return to the
* ```js
* assert(cond, X`...complaint...`)
* ```
* style because of the substantial overhead in
* evaluating the `X` template in the typical `true` case where it is not
* needed. And we do not want to return to the
* ```js
* assert.fail(X`...complaint...`)`
* ```
* because of the verbosity and loss of readability. Instead, until/unless
* https://github.com/microsoft/TypeScript/issues/51426 is fixed, for those
* new-style assertions where this loss of static reasoning is a problem,
* instead express the assertion as
* ```js
* if (!cond) {
* Fail`...complaint...`;
* }
* ```
* or, if needed,
* ```js
* if (!cond) {
* // `throw` is noop since `Fail` throws. But linter confused
* throw Fail`...complaint...`;
* }
* ```
* This avoid the TypeScript bugs that cause the loss of static reasoning,
* but with no loss of efficiency and little loss of readability.
*/
/**
* assert that expr is truthy, with an optional details to describe

@@ -290,2 +348,3 @@ * the assertion. It is a tagged template literal like

* details: DetailsTag,
* Fail: FailTag,
* quote: AssertQuote,

@@ -292,0 +351,0 @@ * makeAssert: MakeAssert,

7

src/eval-scope.js

@@ -5,3 +5,3 @@ import { FERAL_EVAL, create, defineProperties, freeze } from './commons.js';

const { details: d } = assert;
const { Fail } = assert;

@@ -77,6 +77,3 @@ // We attempt to frustrate stack bumping attacks on the safe evaluator

if (evalScopeKit.revoked !== null) {
// eslint-disable-next-line @endo/no-polymorphic-call
assert.fail(
d`a handler did not reset allowNextEvalToBeUnsafe ${this.revoked.err}`,
);
Fail`a handler did not reset allowNextEvalToBeUnsafe ${this.revoked.err}`;
}

@@ -83,0 +80,0 @@ // Allow next reference to eval produce the unsafe FERAL_EVAL.

31

src/lockdown-shim.js

@@ -58,3 +58,3 @@ // Copyright (C) 2018 Agoric

const { details: d, quote: q } = assert;
const { Fail, details: d, quote: q } = assert;

@@ -86,3 +86,2 @@ /** @type {Error=} */

* @param {Array<Transform>} [options.__shimTransforms__]
* @param {Object} [options.globalLexicals]
*/

@@ -197,8 +196,6 @@

assert(
evalTaming === 'unsafeEval' ||
evalTaming === 'safeEval' ||
evalTaming === 'noEval',
d`lockdown(): non supported option evalTaming: ${q(evalTaming)}`,
);
evalTaming === 'unsafeEval' ||
evalTaming === 'safeEval' ||
evalTaming === 'noEval' ||
Fail`lockdown(): non supported option evalTaming: ${q(evalTaming)}`;

@@ -208,12 +205,11 @@ // Assert that only supported options were passed.

const extraOptionsNames = ownKeys(extraOptions);
assert(
extraOptionsNames.length === 0,
d`lockdown(): non supported option ${q(extraOptionsNames)}`,
);
extraOptionsNames.length === 0 ||
Fail`lockdown(): non supported option ${q(extraOptionsNames)}`;
assert(
priorLockdown === undefined,
`Already locked down at ${priorLockdown} (SES_ALREADY_LOCKED_DOWN)`,
TypeError,
);
priorLockdown === undefined ||
// eslint-disable-next-line @endo/no-polymorphic-call
assert.fail(
d`Already locked down at ${priorLockdown} (SES_ALREADY_LOCKED_DOWN)`,
TypeError,
);
priorLockdown = new TypeError('Prior lockdown (SES_ALREADY_LOCKED_DOWN)');

@@ -260,3 +256,2 @@ // Tease V8 to generate the stack string and release the closures the stack

if (seemsToBeLockedDown()) {
// eslint-disable-next-line @endo/no-polymorphic-call
throw new TypeError(

@@ -263,0 +258,0 @@ `Already locked down but not by this SES instance (SES_MULTIPLE_INSTANCES)`,

20

src/make-evaluate.js

@@ -29,3 +29,3 @@ // @ts-check

* @param {object} context.evalScope
* @param {object} context.globalLexicals
* @param {object} context.moduleLexicals
* @param {object} context.globalObject

@@ -35,5 +35,5 @@ * @param {object} context.scopeTerminator

export const makeEvaluate = context => {
const { globalObjectConstants, globalLexicalConstants } = getScopeConstants(
const { globalObjectConstants, moduleLexicalConstants } = getScopeConstants(
context.globalObject,
context.globalLexicals,
context.moduleLexicals,
);

@@ -44,5 +44,5 @@ const globalObjectOptimizer = buildOptimizer(

);
const globalLexicalOptimizer = buildOptimizer(
globalLexicalConstants,
'globalLexicals',
const moduleLexicalOptimizer = buildOptimizer(
moduleLexicalConstants,
'moduleLexicals',
);

@@ -63,3 +63,3 @@

// objects and not in global scope.
// b) `globalLexicals` which provide a way to introduce free variables
// b) `moduleLexicals` which provide a way to introduce free variables
// that are not available on the globalObject.

@@ -78,3 +78,3 @@ // c) `globalObject` is the global scope object of the evaluator, aka the

// - The `optimizer` strings only lookup values on the `globalObject` and
// `globalLexicals` objects by construct. Keywords like 'function' are
// `moduleLexicals` objects by construct. Keywords like 'function' are
// reserved and cannot be used as a variable, so they are excluded from the

@@ -100,6 +100,6 @@ // optimizer. Furthermore to prevent shadowing 'eval', while a valid

with (this.globalObject) {
with (this.globalLexicals) {
with (this.moduleLexicals) {
with (this.evalScope) {
${globalObjectOptimizer}
${globalLexicalOptimizer}
${moduleLexicalOptimizer}
return function() {

@@ -106,0 +106,0 @@ 'use strict';

14

src/make-function-constructor.js

@@ -10,2 +10,4 @@ import {

const { Fail } = assert;
/*

@@ -71,12 +73,8 @@ * makeFunctionConstructor()

// Assert identity of Function.__proto__ accross all compartments
assert(
getPrototypeOf(FERAL_FUNCTION) === FERAL_FUNCTION.prototype,
'Function prototype is the same accross compartments',
);
assert(
getPrototypeOf(newFunction) === FERAL_FUNCTION.prototype,
'Function constructor prototype is the same accross compartments',
);
getPrototypeOf(FERAL_FUNCTION) === FERAL_FUNCTION.prototype ||
Fail`Function prototype is the same accross compartments`;
getPrototypeOf(newFunction) === FERAL_FUNCTION.prototype ||
Fail`Function constructor prototype is the same accross compartments`;
return newFunction;
};

11

src/make-safe-evaluator.js

@@ -12,3 +12,3 @@ // Portions adapted from V8 - Copyright 2016 the V8 project authors.

const { details: d } = assert;
const { Fail } = assert;

@@ -22,3 +22,3 @@ /**

* @param {Object} options.globalObject
* @param {Object} [options.globalLexicals]
* @param {Object} [options.moduleLexicals]
* @param {Array<Transform>} [options.globalTransforms]

@@ -29,3 +29,3 @@ * @param {bool} [options.sloppyGlobalsMode]

globalObject,
globalLexicals = {},
moduleLexicals = {},
globalTransforms = [],

@@ -42,3 +42,3 @@ sloppyGlobalsMode = false,

evalScope,
globalLexicals,
moduleLexicals,
globalObject,

@@ -107,4 +107,3 @@ scopeTerminator,

// See https://github.com/Agoric/SES-shim/issues/490
// eslint-disable-next-line @endo/no-polymorphic-call
assert.fail(d`handler did not reset allowNextEvalToBeUnsafe ${err}`);
Fail`handler did not reset allowNextEvalToBeUnsafe ${err}`;
}

@@ -111,0 +110,0 @@ }

12

src/module-instance.js

@@ -155,6 +155,6 @@ import { assert } from './error/assert.js';

// {_localName_: accessor} proxy traps for globalLexicals and live bindings.
// The globalLexicals object is frozen and the corresponding properties of
// localLexicals must be immutable, so we copy the descriptors.
const localLexicals = create(null);
// {_localName_: accessor} proxy traps for moduleLexicals and live bindings.
// The moduleLexicals object is frozen and the corresponding properties of
// moduleLexicals must be immutable, so we copy the descriptors.
const moduleLexicals = create(null);

@@ -325,3 +325,3 @@ // {_localName_: init(initValue) -> initValue} used by the

if (setProxyTrap) {
defineProperty(localLexicals, localName, {
defineProperty(moduleLexicals, localName, {
get,

@@ -442,3 +442,3 @@ set,

transforms: __shimTransforms__,
__moduleShimLexicals__: localLexicals,
__moduleShimLexicals__: moduleLexicals,
});

@@ -445,0 +445,0 @@ let didThrow = false;

58

src/module-link.js

@@ -29,3 +29,3 @@ /* eslint-disable no-underscore-dangle */

const { quote: q } = assert;
const { Fail, quote: q } = assert;

@@ -74,14 +74,10 @@ // `link` creates `ModuleInstances` and `ModuleNamespaces` for a module and its

const { __fixedExportMap__, __liveExportMap__ } = staticModuleRecord;
assert(
isObject(__fixedExportMap__),
`Property '__fixedExportMap__' of a precompiled module record must be an object, got ${q(
isObject(__fixedExportMap__) ||
Fail`Property '__fixedExportMap__' of a precompiled module record must be an object, got ${q(
__fixedExportMap__,
)}, for module ${q(moduleSpecifier)}`,
);
assert(
isObject(__liveExportMap__),
`Property '__liveExportMap__' of a precompiled module record must be an object, got ${q(
)}, for module ${q(moduleSpecifier)}`;
isObject(__liveExportMap__) ||
Fail`Property '__liveExportMap__' of a precompiled module record must be an object, got ${q(
__liveExportMap__,
)}, for module ${q(moduleSpecifier)}`,
);
)}, for module ${q(moduleSpecifier)}`;
}

@@ -98,36 +94,26 @@

const { exports } = staticModuleRecord;
assert(
isArray(exports),
`Property 'exports' of a third-party static module record must be an array, got ${q(
isArray(exports) ||
Fail`Property 'exports' of a third-party static module record must be an array, got ${q(
exports,
)}, for module ${q(moduleSpecifier)}`,
);
)}, for module ${q(moduleSpecifier)}`;
}
function validateStaticModuleRecord(staticModuleRecord, moduleSpecifier) {
assert(
isObject(staticModuleRecord),
`Static module records must be of type object, got ${q(
isObject(staticModuleRecord) ||
Fail`Static module records must be of type object, got ${q(
staticModuleRecord,
)}, for module ${q(moduleSpecifier)}`,
);
)}, for module ${q(moduleSpecifier)}`;
const { imports, exports, reexports = [] } = staticModuleRecord;
assert(
isArray(imports),
`Property 'imports' of a static module record must be an array, got ${q(
isArray(imports) ||
Fail`Property 'imports' of a static module record must be an array, got ${q(
imports,
)}, for module ${q(moduleSpecifier)}`,
);
assert(
isArray(exports),
`Property 'exports' of a precompiled module record must be an array, got ${q(
)}, for module ${q(moduleSpecifier)}`;
isArray(exports) ||
Fail`Property 'exports' of a precompiled module record must be an array, got ${q(
exports,
)}, for module ${q(moduleSpecifier)}`,
);
assert(
isArray(reexports),
`Property 'reexports' of a precompiled module record must be an array if present, got ${q(
)}, for module ${q(moduleSpecifier)}`;
isArray(reexports) ||
Fail`Property 'reexports' of a precompiled module record must be an array if present, got ${q(
reexports,
)}, for module ${q(moduleSpecifier)}`,
);
)}, for module ${q(moduleSpecifier)}`;
}

@@ -134,0 +120,0 @@

11

src/module-load.js

@@ -30,3 +30,3 @@ // For brevity, in this file, as in module-link.js, the term "moduleRecord"

const { details: d, quote: q } = assert;
const { Fail, details: d, quote: q } = assert;

@@ -174,8 +174,5 @@ const noop = () => {};

if (staticModuleRecord === null || typeof staticModuleRecord !== 'object') {
// eslint-disable-next-line @endo/no-polymorphic-call
assert.fail(
d`importHook must return a promise for an object, for module ${q(
moduleSpecifier,
)} in compartment ${q(compartment.name)}`,
);
Fail`importHook must return a promise for an object, for module ${q(
moduleSpecifier,
)} in compartment ${q(compartment.name)}`;
}

@@ -182,0 +179,0 @@

16

src/scope-constants.js

@@ -147,16 +147,16 @@ import {

* @param {Object} globalObject
* @param {Object} globalLexicals
* @param {Object} moduleLexicals
*/
export const getScopeConstants = (globalObject, globalLexicals = {}) => {
export const getScopeConstants = (globalObject, moduleLexicals = {}) => {
// getOwnPropertyNames() does ignore Symbols so we don't need to
// filter them out.
const globalObjectNames = getOwnPropertyNames(globalObject);
const globalLexicalNames = getOwnPropertyNames(globalLexicals);
const moduleLexicalNames = getOwnPropertyNames(moduleLexicals);
// Collect all valid & immutable identifiers from the endowments.
const globalLexicalConstants = arrayFilter(
globalLexicalNames,
const moduleLexicalConstants = arrayFilter(
moduleLexicalNames,
name =>
isValidIdentifierName(name) &&
isImmutableDataProperty(globalLexicals, name),
isImmutableDataProperty(moduleLexicals, name),
);

@@ -171,3 +171,3 @@

// lookup on the endowments.
!arrayIncludes(globalLexicalNames, name) &&
!arrayIncludes(moduleLexicalNames, name) &&
isValidIdentifierName(name) &&

@@ -179,4 +179,4 @@ isImmutableDataProperty(globalObject, name),

globalObjectConstants,
globalLexicalConstants,
moduleLexicalConstants,
};
};

7

src/strict-scope-terminator.js

@@ -14,3 +14,3 @@ import {

const { details: d, quote: q } = assert;
const { Fail, quote: q } = assert;

@@ -28,6 +28,3 @@ /**

get(_shadow, prop) {
// eslint-disable-next-line @endo/no-polymorphic-call
assert.fail(
d`Please report unexpected scope handler trap: ${q(String(prop))}`,
);
Fail`Please report unexpected scope handler trap: ${q(String(prop))}`;
},

@@ -34,0 +31,0 @@ }),

16

src/tame-locale-methods.js

@@ -12,3 +12,3 @@ import {

const { details: d, quote: q } = assert;
const { Fail, quote: q } = assert;

@@ -35,3 +35,3 @@ const localePattern = /^(\w*[a-z])Locale([A-Z]\w*)$/;

}
assert(s === that, d`expected ${q(s)} and ${q(that)} to compare`);
s === that || Fail`expected ${q(s)} and ${q(that)} to compare`;
return 0;

@@ -66,12 +66,8 @@ },

if (match) {
assert(
typeof intrinsic[methodName] === 'function',
d`expected ${q(methodName)} to be a function`,
);
typeof intrinsic[methodName] === 'function' ||
Fail`expected ${q(methodName)} to be a function`;
const nonLocaleMethodName = `${match[1]}${match[2]}`;
const method = intrinsic[nonLocaleMethodName];
assert(
typeof method === 'function',
d`function ${q(nonLocaleMethodName)} not found`,
);
typeof method === 'function' ||
Fail`function ${q(nonLocaleMethodName)} not found`;
defineProperty(intrinsic, methodName, { value: method });

@@ -78,0 +74,0 @@ }

dist/lockdown.cjs

Sorry, the diff of this file is not supported yet

dist/lockdown.mjs

Sorry, the diff of this file is not supported yet

dist/lockdown.umd.js

Sorry, the diff of this file is too big to display

dist/lockdown.umd.min.js

Sorry, the diff of this file is too big to display

dist/ses.cjs

Sorry, the diff of this file is not supported yet

dist/ses.mjs

Sorry, the diff of this file is not supported yet

dist/ses.umd.js

Sorry, the diff of this file is too big to display

dist/ses.umd.min.js

Sorry, the diff of this file is too big to display

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

About

Packages

npm

Go

Maven

PyPI

Rubygems

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc