socket-security[bot]
commented
1 year ago Socket Security Pull Request Report
Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.
📜 Install scripts
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
| Package | Script field | Source |
|---|---|---|
| utf-8-validate@6.0.2 (upgraded) | install |
package.json via simple-websocket@9.1.0, ws@7.5.9 |
Pull request report summary
| Issue | Status |
|---|---|
| Install scripts | ⚠️ 1 issue |
| Native code | ✅ 0 issues |
| Bin script confusion | ✅ 0 issues |
| Bin script shell injection | ✅ 0 issues |
| Unresolved require | ✅ 0 issues |
| Invalid package.json | ✅ 0 issues |
| HTTP dependency | ✅ 0 issues |
| Git dependency | ✅ 0 issues |
| Potential typo squat | ✅ 0 issues |
| Known Malware | ✅ 0 issues |
| Telemetry | ✅ 0 issues |
| Protestware/Troll package | ✅ 0 issues |
Bot Commands
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2
@SocketSecurity ignore utf-8-validate@6.0.2
Powered by socket.dev
DiegoRBaquero
github-actions[bot]
renovate[bot]
This PR contains the following updates:
^5.0.5->^6.0.0Release Notes
websockets/utf-8-validate
### [`v6.0.3`](https://togithub.com/websockets/utf-8-validate/compare/v6.0.2...v6.0.3) [Compare Source](https://togithub.com/websockets/utf-8-validate/compare/v6.0.2...v6.0.3) ### [`v6.0.2`](https://togithub.com/websockets/utf-8-validate/compare/v6.0.1...v6.0.2) [Compare Source](https://togithub.com/websockets/utf-8-validate/compare/v6.0.1...v6.0.2) ### [`v6.0.1`](https://togithub.com/websockets/utf-8-validate/compare/v6.0.0...v6.0.1) [Compare Source](https://togithub.com/websockets/utf-8-validate/compare/v6.0.0...v6.0.1) ### [`v6.0.0`](https://togithub.com/websockets/utf-8-validate/compare/v5.0.10...v6.0.0) [Compare Source](https://togithub.com/websockets/utf-8-validate/compare/v5.0.10...v6.0.0)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.