Closed josephmcg closed 1 year ago
Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.
This package re-exports a well known shell command via an npm bin script. This is possibly a supply chain attack
Packages should not export bin scripts which conflict with well known shell commands
Package | Bin script | Location |
---|---|---|
@cnakazawa/watch@1.0.4 (added) | watch |
package.json via cypress-image-snapshot@4.0.1, jest-image-snapshot@4.2.0, jest@26.6.3, @jest/core@26.6.3, jest-haste-map@26.6.2, sane@4.1.0 |
Issue | Status |
---|---|
Install scripts | ✅ 0 issues |
Native code | ✅ 0 issues |
Bin script confusion | ✅ 0 issues |
Bin script shell injection | ⚠️ 1 issue |
Unresolved require | ✅ 0 issues |
Invalid package.json | ✅ 0 issues |
HTTP dependency | ✅ 0 issues |
Git dependency | ✅ 0 issues |
Non-existent author | ✅ 0 issues |
Potential typo squat | ✅ 0 issues |
Known Malware | ✅ 0 issues |
Telemetry | ✅ 0 issues |
Protestware/Troll package | ✅ 0 issues |
To ignore an alert, reply with a comment starting with @SocketSecurity ignore
followed by a space separated list of package-name@version
specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2
@SocketSecurity ignore @cnakazawa/watch@1.0.4
Powered by socket.dev
Download the .APK for this pull request:
Yes we also noticed that some timezones were missing and especially Ukrainian people were upset on issue.satellite.im
What this PR does 📖
Which issue(s) this PR fixes 🔨
Special notes for reviewers 🗒️
Additional comments 🎤