socket.io-client — Greenflagged

Realtime application framework client

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

rauchgdarrachequesne

Keywords

realtimeframeworkwebsockettcpeventsclient

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:dist/socket.io.msgpack.min.js	AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library.	ai	2026/04/23
dependencies	unvetted-dep:bind	AI (dependencies): bind is a legitimate utility library; package's 5419-day history and ecosystem trust justify acceptance.	ai	2026/04/22
dependencies	unvetted-dep:has-binary-data	AI (dependencies): has-binary-data is a legitimate utility; stable dependency for this mature package.	ai	2026/04/22
source-diff	net-exec-file:dist/socket.io.min.js	AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library.	ai	2026/04/22
source-diff	net-exec-file:dist/socket.io.slim.min.js	AI (source-diff): Minified webpack bundle; network+execution pattern is expected for WebSocket client code, not malware.	ai	2026/04/22
phantom-deps	phantom-dep:object-component	AI (phantom-deps): object-component is a legitimate dependency used in bundled client libraries; phantom-dep pattern is stable for socket.io-client.	ai	2026/04/22
dependencies	unvetted-dep:has-binary	AI (dependencies): has-binary is a legitimate utility dependency; no security concern for socket.io-client.	ai	2026/04/22
dependencies	unvetted-dep:active-x-obfuscator	AI (dependencies): active-x-obfuscator is a legitimate utility for IE ActiveX string obfuscation, appropriate for a cross-browser socket library. Its use here is consistent with socket.io-client's documented browser support goals.	ai	2026/04/22
dependencies	unvetted-dep:component-bind	AI (dependencies): component-bind is a long-standing micro-utility in the Socket.IO/Component ecosystem; stable false positive for this package.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): darrachequesne is the documented primary Socket.IO maintainer; this is a legitimate maintainer addition, not a takeover.	ai	2026/04/22
source-diff	net-exec-file:dist/socket.io.js	AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): darrachequesne is the documented primary Socket.IO maintainer since 2017; transition from rauchg is a well-known legitimate handoff within Automattic.	ai	2026/04/22
source-diff	obfuscated-file:dist/socket.io.js	AI (source-diff): Standard webpack browser bundle for socket.io-client; minified output is expected and documented for this package's dist/ directory.	ai	2026/04/22
source-diff	net-exec-file:dist/socket.io.dev.js	AI (source-diff): Standard webpack UMD browser bundle for a WebSocket networking library. Network calls and module loading are core functionality, not malware indicators.	ai	2026/04/22
source-diff	net-exec-file:dist/socket.io.slim.dev.js	AI (source-diff): Standard webpack UMD browser bundle (slim variant). Network calls and module loading are core functionality, not malware indicators.	ai	2026/04/22
source-diff	net-exec-file:dist/socket.io.slim.js	AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware.	ai	2026/04/22
source-diff	obfuscated-file:dist/socket.io.slim.js	AI (source-diff): Standard webpack slim browser bundle for socket.io-client; minified output is expected for this package's dist/ directory.	ai	2026/04/22
npm-metadata	url-dep:bind	AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk.	ai	2026/04/22
npm-metadata	url-dep:emitter	AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk.	ai	2026/04/22
source-diff	obfuscated-file:coverage/lcov-report/prettify.js	AI (source-diff): Google Code Prettify syntax highlighter included in Istanbul coverage reports; well-known minified file, entirely benign.	ai	2026/04/22
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() is used for JSON parsing in bundled code; standard and safe pattern.	ai	2026/04/22
source-diff	net-exec-file:socket.io.js	AI (source-diff): Browserified socket.io client bundle; network + code execution is expected for WebSocket client library.	ai	2026/04/22
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is within browserified bundle; expected and safe in build output.	ai	2026/04/22
semgrep	semgrep:eval-usage	AI (semgrep): eval() in lib/json.js is part of a bundled JSON2/Crockford parser — a well-known legitimate pattern for JSON parsing in older environments. Not a supply-chain indicator.	ai	2026/04/22
phantom-deps	phantom-dep:@types/component-emitter	AI (phantom-deps): @types/component-emitter is intentionally listed as a runtime dep for type resolution in this package; stable false positive for socket.io-client.	ai	2026/04/22
provenance	no-provenance	AI (provenance): Provenance attestation was not standard practice in 2014; metadata signal only.	ai	2026/04/22
publish-pattern	new-deps-added	AI (publish-pattern): All 11 new dependencies are established utility packages appropriate for WebSocket client; no suspicious additions.	ai	2026/04/22
source-diff	large-new-source-files	AI (source-diff): Large number of new files reflects the addition of ESM build artifacts and restructured build pipeline, consistent with the version diff showing new build/compile scripts.	ai	2026/04/22
source-diff	net-exec-file:dist/socket.io.esm.min.js	AI (source-diff): socket.io-client legitimately ships minified browser bundles with network calls and cross-env global accessors (Function('return this')). This is expected build output, not malware.	ai	2026/04/22
dependencies	unvetted-dep:engine.io-client	AI (dependencies): engine.io-client is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client.	ai	2026/04/21
dependencies	unvetted-dep:socket.io-parser	AI (dependencies): socket.io-parser is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client.	ai	2026/04/21