socket.io-client
Realtime application framework client
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/socket.io.msgpack.min.js | AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library. | ai | |
| dependencies | unvetted-dep:bind | AI (dependencies): bind is a legitimate utility library; package's 5419-day history and ecosystem trust justify acceptance. | ai | |
| dependencies | unvetted-dep:has-binary-data | AI (dependencies): has-binary-data is a legitimate utility; stable dependency for this mature package. | ai | |
| source-diff | net-exec-file:dist/socket.io.min.js | AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library. | ai | |
| source-diff | net-exec-file:dist/socket.io.slim.min.js | AI (source-diff): Minified webpack bundle; network+execution pattern is expected for WebSocket client code, not malware. | ai | |
| phantom-deps | phantom-dep:object-component | AI (phantom-deps): object-component is a legitimate dependency used in bundled client libraries; phantom-dep pattern is stable for socket.io-client. | ai | |
| dependencies | unvetted-dep:has-binary | AI (dependencies): has-binary is a legitimate utility dependency; no security concern for socket.io-client. | ai | |
| dependencies | unvetted-dep:active-x-obfuscator | AI (dependencies): active-x-obfuscator is a legitimate utility for IE ActiveX string obfuscation, appropriate for a cross-browser socket library. Its use here is consistent with socket.io-client's documented browser support goals. | ai | |
| dependencies | unvetted-dep:component-bind | AI (dependencies): component-bind is a long-standing micro-utility in the Socket.IO/Component ecosystem; stable false positive for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): darrachequesne is the documented primary Socket.IO maintainer; this is a legitimate maintainer addition, not a takeover. | ai | |
| source-diff | net-exec-file:dist/socket.io.js | AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware. | ai | |
| provenance | publisher-changed | AI (provenance): darrachequesne is the documented primary Socket.IO maintainer since 2017; transition from rauchg is a well-known legitimate handoff within Automattic. | ai | |
| source-diff | obfuscated-file:dist/socket.io.js | AI (source-diff): Standard webpack browser bundle for socket.io-client; minified output is expected and documented for this package's dist/ directory. | ai | |
| source-diff | net-exec-file:dist/socket.io.dev.js | AI (source-diff): Standard webpack UMD browser bundle for a WebSocket networking library. Network calls and module loading are core functionality, not malware indicators. | ai | |
| source-diff | net-exec-file:dist/socket.io.slim.dev.js | AI (source-diff): Standard webpack UMD browser bundle (slim variant). Network calls and module loading are core functionality, not malware indicators. | ai | |
| source-diff | net-exec-file:dist/socket.io.slim.js | AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware. | ai | |
| source-diff | obfuscated-file:dist/socket.io.slim.js | AI (source-diff): Standard webpack slim browser bundle for socket.io-client; minified output is expected for this package's dist/ directory. | ai | |
| npm-metadata | url-dep:bind | AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk. | ai | |
| npm-metadata | url-dep:emitter | AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk. | ai | |
| source-diff | obfuscated-file:coverage/lcov-report/prettify.js | AI (source-diff): Google Code Prettify syntax highlighter included in Istanbul coverage reports; well-known minified file, entirely benign. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is used for JSON parsing in bundled code; standard and safe pattern. | ai | |
| source-diff | net-exec-file:socket.io.js | AI (source-diff): Browserified socket.io client bundle; network + code execution is expected for WebSocket client library. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is within browserified bundle; expected and safe in build output. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in lib/json.js is part of a bundled JSON2/Crockford parser — a well-known legitimate pattern for JSON parsing in older environments. Not a supply-chain indicator. | ai | |
| phantom-deps | phantom-dep:@types/component-emitter | AI (phantom-deps): @types/component-emitter is intentionally listed as a runtime dep for type resolution in this package; stable false positive for socket.io-client. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation was not standard practice in 2014; metadata signal only. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All 11 new dependencies are established utility packages appropriate for WebSocket client; no suspicious additions. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large number of new files reflects the addition of ESM build artifacts and restructured build pipeline, consistent with the version diff showing new build/compile scripts. | ai | |
| source-diff | net-exec-file:dist/socket.io.esm.min.js | AI (source-diff): socket.io-client legitimately ships minified browser bundles with network calls and cross-env global accessors (Function('return this')). This is expected build output, not malware. | ai | |
| dependencies | unvetted-dep:engine.io-client | AI (dependencies): engine.io-client is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client. | ai | |
| dependencies | unvetted-dep:socket.io-parser | AI (dependencies): socket.io-parser is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client. | ai |
Versions (showing 51 of 119)
| Version | Deps | Published |
|---|---|---|
| 4.8.3 | 4 / 0 | |
| 4.8.2 | 4 / 0 | |
| 4.8.1 | 4 / 0 | |
| 4.8.0 | 4 / 0 | |
| 4.7.5 | 4 / 35 | |
| 4.7.4 | 4 / 35 | |
| 4.7.3 | 4 / 35 | |
| 4.7.2 | 4 / 35 | |
| 4.7.1 | 4 / 35 | |
| 4.7.0 | 4 / 35 | |
| 4.6.2 | 4 / 35 | |
| 4.6.1 | 4 / 35 | |
| 4.6.0 | 4 / 35 | |
| 4.5.4 | 4 / 35 | |
| 4.5.3 | 4 / 37 | |
| 4.5.2 | 4 / 37 | |
| 4.5.1 | 4 / 37 | |
| 4.5.0 | 4 / 37 | |
| 4.4.1 | 6 / 37 | |
| 4.4.0 | 6 / 37 | |
| 4.3.2 | 6 / 37 | |
| 4.3.1 | 6 / 37 | |
| 4.3.0 | 6 / 37 | |
| 4.2.0 | 7 / 31 | |
| 4.1.3 | 7 / 29 | |
| 4.1.2 | 7 / 32 | |
| 4.1.1 | 7 / 32 | |
| 4.1.0 | 7 / 32 | |
| 4.0.2 | 7 / 32 | |
| 4.0.1 | 7 / 32 | |
| 4.0.0 | 7 / 32 | |
| 3.1.3 | 7 / 31 | |
| 3.1.2 | 7 / 31 | |
| 3.1.1 | 7 / 31 | |
| 3.1.0 | 7 / 31 | |
| 3.0.5 | 7 / 31 | |
| 3.0.4 | 8 / 31 | |
| 3.0.3 | 8 / 31 | |
| 3.0.2 | 8 / 30 | |
| 3.0.1 | 8 / 30 | |
| 3.0.0 | 8 / 30 | |
| 2.5.0 | 11 / 29 | |
| 2.4.0 | 11 / 29 | |
| 2.3.1 | 11 / 29 | |
| 2.3.0 | 14 / 27 | |
| 2.2.0 | 14 / 27 | |
| 2.1.1 | 14 / 27 | |
| 2.1.0 | 14 / 27 | |
| 2.0.4 | 13 / 25 | |
| 2.0.3 | 13 / 25 | |
| 2.0.2 | 13 / 25 |
v4.8.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.8.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.8.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.5.3
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.2
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.1
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.1
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.2
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.1
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.5.0
5 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.0
5 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.1
8 findingsThis version was published by a different npm account than previous versions on 2020-09-30. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.0
4 findingsThis version was published by a different npm account than previous versions on 2019-09-20. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
4 findingsThis version was published by a different npm account than previous versions on 2018-11-28. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
4 findingsThis version was published by a different npm account than previous versions on 2018-05-17. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
4 findingsThis version was published by a different npm account than previous versions on 2018-03-29. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.4
4 findingsThis version was published by a different npm account than previous versions on 2017-10-22. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.3
6 findingsThis version was published by a different npm account than previous versions on 2017-06-12. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.2
6 findingsThis version was published by a different npm account than previous versions on 2017-06-01. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.