← Home

socket.io-client

npm Repository Homepage

Realtime application framework client

100
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

rauchgdarrachequesne

Keywords

realtimeframeworkwebsockettcpeventsclient

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:dist/socket.io.msgpack.min.js AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library. ai
dependencies unvetted-dep:bind AI (dependencies): bind is a legitimate utility library; package's 5419-day history and ecosystem trust justify acceptance. ai
dependencies unvetted-dep:has-binary-data AI (dependencies): has-binary-data is a legitimate utility; stable dependency for this mature package. ai
source-diff net-exec-file:dist/socket.io.min.js AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library. ai
source-diff net-exec-file:dist/socket.io.slim.min.js AI (source-diff): Minified webpack bundle; network+execution pattern is expected for WebSocket client code, not malware. ai
phantom-deps phantom-dep:object-component AI (phantom-deps): object-component is a legitimate dependency used in bundled client libraries; phantom-dep pattern is stable for socket.io-client. ai
dependencies unvetted-dep:has-binary AI (dependencies): has-binary is a legitimate utility dependency; no security concern for socket.io-client. ai
dependencies unvetted-dep:active-x-obfuscator AI (dependencies): active-x-obfuscator is a legitimate utility for IE ActiveX string obfuscation, appropriate for a cross-browser socket library. Its use here is consistent with socket.io-client's documented browser support goals. ai
dependencies unvetted-dep:component-bind AI (dependencies): component-bind is a long-standing micro-utility in the Socket.IO/Component ecosystem; stable false positive for this package. ai
maintainer-change maintainer-added AI (maintainer-change): darrachequesne is the documented primary Socket.IO maintainer; this is a legitimate maintainer addition, not a takeover. ai
source-diff net-exec-file:dist/socket.io.js AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware. ai
provenance publisher-changed AI (provenance): darrachequesne is the documented primary Socket.IO maintainer since 2017; transition from rauchg is a well-known legitimate handoff within Automattic. ai
source-diff obfuscated-file:dist/socket.io.js AI (source-diff): Standard webpack browser bundle for socket.io-client; minified output is expected and documented for this package's dist/ directory. ai
source-diff net-exec-file:dist/socket.io.dev.js AI (source-diff): Standard webpack UMD browser bundle for a WebSocket networking library. Network calls and module loading are core functionality, not malware indicators. ai
source-diff net-exec-file:dist/socket.io.slim.dev.js AI (source-diff): Standard webpack UMD browser bundle (slim variant). Network calls and module loading are core functionality, not malware indicators. ai
source-diff net-exec-file:dist/socket.io.slim.js AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware. ai
source-diff obfuscated-file:dist/socket.io.slim.js AI (source-diff): Standard webpack slim browser bundle for socket.io-client; minified output is expected for this package's dist/ directory. ai
npm-metadata url-dep:bind AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk. ai
npm-metadata url-dep:emitter AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk. ai
source-diff obfuscated-file:coverage/lcov-report/prettify.js AI (source-diff): Google Code Prettify syntax highlighter included in Istanbul coverage reports; well-known minified file, entirely benign. ai
semgrep semgrep:new-function-constructor AI (semgrep): new Function() is used for JSON parsing in bundled code; standard and safe pattern. ai
source-diff net-exec-file:socket.io.js AI (source-diff): Browserified socket.io client bundle; network + code execution is expected for WebSocket client library. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is within browserified bundle; expected and safe in build output. ai
semgrep semgrep:eval-usage AI (semgrep): eval() in lib/json.js is part of a bundled JSON2/Crockford parser — a well-known legitimate pattern for JSON parsing in older environments. Not a supply-chain indicator. ai
phantom-deps phantom-dep:@types/component-emitter AI (phantom-deps): @types/component-emitter is intentionally listed as a runtime dep for type resolution in this package; stable false positive for socket.io-client. ai
provenance no-provenance AI (provenance): Provenance attestation was not standard practice in 2014; metadata signal only. ai
publish-pattern new-deps-added AI (publish-pattern): All 11 new dependencies are established utility packages appropriate for WebSocket client; no suspicious additions. ai
source-diff large-new-source-files AI (source-diff): Large number of new files reflects the addition of ESM build artifacts and restructured build pipeline, consistent with the version diff showing new build/compile scripts. ai
source-diff net-exec-file:dist/socket.io.esm.min.js AI (source-diff): socket.io-client legitimately ships minified browser bundles with network calls and cross-env global accessors (Function('return this')). This is expected build output, not malware. ai
dependencies unvetted-dep:engine.io-client AI (dependencies): engine.io-client is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client. ai
dependencies unvetted-dep:socket.io-parser AI (dependencies): socket.io-parser is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client. ai

Versions (showing 100 of 119)

Version Deps Published
4.8.3 4 / 0
4.8.2 4 / 0
4.8.1 4 / 0
4.8.0 4 / 0
4.7.5 4 / 35
4.7.4 4 / 35
4.7.3 4 / 35
4.7.2 4 / 35
4.7.1 4 / 35
4.7.0 4 / 35
4.6.2 4 / 35
4.6.1 4 / 35
4.6.0 4 / 35
4.5.4 4 / 35
4.5.3 4 / 37
4.5.2 4 / 37
4.5.1 4 / 37
4.5.0 4 / 37
4.4.1 6 / 37
4.4.0 6 / 37
4.3.2 6 / 37
4.3.1 6 / 37
4.3.0 6 / 37
4.2.0 7 / 31
4.1.3 7 / 29
4.1.2 7 / 32
4.1.1 7 / 32
4.1.0 7 / 32
4.0.2 7 / 32
4.0.1 7 / 32
4.0.0 7 / 32
3.1.3 7 / 31
3.1.2 7 / 31
3.1.1 7 / 31
3.1.0 7 / 31
3.0.5 7 / 31
3.0.4 8 / 31
3.0.3 8 / 31
3.0.2 8 / 30
3.0.1 8 / 30
3.0.0 8 / 30
2.5.0 11 / 29
2.4.0 11 / 29
2.3.1 11 / 29
2.3.0 14 / 27
2.2.0 14 / 27
2.1.1 14 / 27
2.1.0 14 / 27
2.0.4 13 / 25
2.0.3 13 / 25
2.0.2 13 / 25
2.0.1 12 / 25
2.0.0 12 / 25
1.7.4 11 / 29
1.7.3 11 / 29
1.7.2 11 / 29
1.7.1 11 / 29
1.7.0 11 / 29
1.6.0 11 / 28
1.5.1 11 / 27
1.5.0 11 / 26
1.4.8 11 / 13
1.4.7 11 / 13
1.4.6 11 / 13
1.4.5 11 / 13
1.4.4 11 / 13
1.4.3 11 / 13
1.4.2 11 / 13
1.4.1 11 / 13
1.4.0 11 / 11
1.3.7 11 / 10
1.3.6 11 / 10
1.3.5 11 / 10
1.3.4 11 / 10
1.3.3 11 / 10
1.3.2 11 / 10
1.3.1 11 / 10
1.3.0 11 / 10
1.2.1 10 / 10
1.2.0 10 / 10
1.1.0 10 / 10
1.0.6 10 / 10
1.0.5 10 / 10
1.0.4 10 / 11
1.0.3 10 / 11
1.0.2 10 / 11
1.0.1 10 / 11
0.9.17 4 / 6
0.9.16 4 / 7
0.9.15 4 / 7
0.9.11 4 / 7
0.9.10 4 / 6
0.9.9 4 / 6
0.9.8 4 / 6
0.9.7 4 / 6
0.9.6 4 / 6
0.9.5 4 / 6
0.9.4 4 / 6
0.9.3 4 / 6
0.9.2 4 / 6
Showing 100 of 119 Next page →

v4.8.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.8.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.8.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.7.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.5.3

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.2

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.1

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.0

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.4.1

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.4.0

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.2

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.1

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.0

2 findings
HIGH New file with network + code execution: dist/socket.io.esm.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

2 findings
HIGH New file with network + code execution: dist/socket.io.msgpack.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.0

5 findings
HIGH New file with network + code execution: dist/socket.io.dev.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/socket.io.slim.dev.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.slim.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.0

5 findings
HIGH New file with network + code execution: dist/socket.io.dev.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/socket.io.slim.dev.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.slim.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.1

8 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2020-09-30) provenance

This version was published by a different npm account than previous versions on 2020-09-30. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New file with network + code execution: dist/socket.io.dev.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/socket.io.slim.dev.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.slim.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

4 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2019-09-20) provenance

This version was published by a different npm account than previous versions on 2019-09-20. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

4 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2018-11-28) provenance

This version was published by a different npm account than previous versions on 2018-11-28. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

4 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2018-05-17) provenance

This version was published by a different npm account than previous versions on 2018-05-17. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

4 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2018-03-29) provenance

This version was published by a different npm account than previous versions on 2018-03-29. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.4

4 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2017-10-22) provenance

This version was published by a different npm account than previous versions on 2017-10-22. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.3

6 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2017-06-12) provenance

This version was published by a different npm account than previous versions on 2017-06-12. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.slim.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.2

6 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2017-06-01) provenance

This version was published by a different npm account than previous versions on 2017-06-01. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.slim.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

6 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2017-05-08) provenance

This version was published by a different npm account than previous versions on 2017-05-08. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.slim.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

6 findings
HIGH Publisher changed: rauchg → darrachequesne (on 2017-05-08) provenance

This version was published by a different npm account than previous versions on 2017-05-08. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/socket.io.slim.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/socket.io.slim.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.6.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.6

2 findings
HIGH New file with network + code execution: socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.0

2 findings
HIGH New file with network + code execution: socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.17

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.16

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.15

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.11

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.