socket-security[bot]
commented
1 year ago Socket Security Pull Request Report
Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.
🦀 Bin script shell injection
This package re-exports a well known shell command via an npm bin script. This is possibly a supply chain attack
Packages should not export bin scripts which conflict with well known shell commands
| Package | Bin script | Location |
|---|---|---|
| @cnakazawa/watch@1.0.4 (added) | watch |
package.json via cypress-image-snapshot@4.0.1, jest-image-snapshot@4.2.0, jest@26.6.3, @jest/core@26.6.3, jest-haste-map@26.6.2, sane@4.1.0 |
Pull request report summary
| Issue | Status |
|---|---|
| Install scripts | ✅ 0 issues |
| Native code | ✅ 0 issues |
| Bin script confusion | ✅ 0 issues |
| Bin script shell injection | ⚠️ 1 issue |
| Unresolved require | ✅ 0 issues |
| Invalid package.json | ✅ 0 issues |
| HTTP dependency | ✅ 0 issues |
| Git dependency | ✅ 0 issues |
| Non-existent author | ✅ 0 issues |
| Potential typo squat | ✅ 0 issues |
| Known Malware | ✅ 0 issues |
| Telemetry | ✅ 0 issues |
| Protestware/Troll package | ✅ 0 issues |
Bot Commands
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2
@SocketSecurity ignore @cnakazawa/watch@1.0.4
Powered by socket.dev
github-actions[bot]
molimauro
What this PR does 📖
Which issue(s) this PR fixes 🔨
Special notes for reviewers 🗒️
Additional comments 🎤