detect-provider icon indicating copy to clipboard operation
detect-provider copied to clipboard

Published 20 hours ago • verified publisher icon MetaMask

Upgrade to Yarn v3

Open mcmire opened this issue 2 years ago • 5 comments

We use Yarn v3 for our other libraries, so we're following suit here.

mcmire avatar Jun 07 '23 16:06 mcmire

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSource
New author npm/[email protected]
Install scripts npm/[email protected]
  • Install script: postinstall
  • Source: node -e "try{require('./_postinstall')}catch(e){}" || exit 0
Network access npm/[email protected]
Network access npm/[email protected]
New author npm/[email protected]
New author npm/@sinonjs/[email protected]
New author npm/[email protected]
New author npm/@npmcli/[email protected]
New author npm/[email protected]
Network access npm/[email protected]
New author npm/[email protected]
New author npm/[email protected]
New author npm/[email protected]
Network access npm/@npmcli/[email protected]
Network access npm/@npmcli/[email protected]
Network access npm/@npmcli/[email protected]
Network access npm/@npmcli/[email protected]
Network access npm/@npmcli/[email protected]
New author npm/[email protected]
Unstable ownership npm/[email protected]

View full report↗︎

Next steps

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

What is unstable ownership?

A new collaborator has begun publishing package versions. Package stability and security risk may be elevated.

Try to reduce the amount of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

socket-security[bot] avatar Jun 07 '23 16:06 socket-security[bot]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@babel/[email protected] Transitive: environment +9 173 kB nicolo-ribaudo
npm/@babel/[email protected] None 0 49.1 kB nicolo-ribaudo
npm/@babel/[email protected] Transitive: environment +8 165 kB nicolo-ribaudo
npm/@eslint/[email protected] filesystem, unsafe Transitive: environment, eval +27 4.04 MB eslintbot
npm/@goto-bus-stop/[email protected] Transitive: eval +18 1.78 MB goto-bus-stop
npm/@jridgewell/[email protected] None 0 53.2 kB jridgewell
npm/@jridgewell/[email protected] None +2 263 kB jridgewell
npm/@nodelib/[email protected] filesystem +2 40.6 kB mrmlnc
npm/@nodelib/[email protected] filesystem 0 11.8 kB mrmlnc
npm/@nodelib/[email protected] Transitive: filesystem +5 118 kB mrmlnc
npm/@npmcli/[email protected] environment, network +11 731 kB npm-cli-ops
npm/@npmcli/[email protected] filesystem +3 164 kB gar
npm/@sinonjs/[email protected] None +1 80.8 kB mrgnrdrck
npm/@sinonjs/[email protected] None +3 200 kB mrgnrdrck
npm/@sinonjs/[email protected] None 0 651 kB mrgnrdrck
npm/@types/[email protected] None 0 31.7 kB types
npm/@typescript-eslint/[email protected] Transitive: environment, eval, filesystem, shell, unsafe +131 83.1 MB jameshenry
npm/@typescript-eslint/[email protected] Transitive: environment, eval, filesystem, shell, unsafe +129 80.7 MB jameshenry
npm/@typescript-eslint/[email protected] Transitive: environment, eval, filesystem, shell, unsafe +127 79.9 MB jameshenry
npm/@typescript-eslint/[email protected] None +3 761 kB jameshenry
npm/@typescript-eslint/[email protected] None 0 145 kB jameshenry
npm/@typescript-eslint/[email protected] environment, filesystem +34 68.7 MB jameshenry
npm/@typescript-eslint/[email protected] None +2 201 kB jameshenry
npm/[email protected] None +1 1.23 MB rreverser
npm/[email protected] environment 0 26.1 kB jonschlinkert
npm/[email protected] Transitive: eval +32 2.84 MB ljharb
npm/[email protected] Transitive: eval +32 2.83 MB ljharb
npm/[email protected] Transitive: environment, eval +15 375 kB ljharb
npm/[email protected] None 0 3.4 kB kevva
npm/[email protected] None 0 20.4 kB ljharb
npm/[email protected] None 0 9.62 kB feross
npm/[email protected] filesystem Transitive: environment, eval +63 3.96 MB goto-bus-stop
npm/[email protected] None 0 5.05 kB linusu
npm/[email protected] filesystem Transitive: environment +35 969 kB lukekarrys
npm/[email protected] Transitive: eval +9 203 kB ljharb
npm/[email protected] None +3 63.1 kB sindresorhus
npm/[email protected] None 0 4.98 kB isaacs
npm/[email protected] None +7 204 kB cwmma
npm/[email protected] Transitive: eval +40 1.02 MB ljharb
npm/[email protected] None 0 8.11 kB thlorenz
npm/[email protected] Transitive: eval +6 151 kB ljharb
npm/[email protected] None 0 10.7 kB ljharb
npm/[email protected] None +2 45.3 kB indutny
npm/[email protected] None +6 1.45 MB bret
npm/[email protected] None 0 429 kB explodingcabbage
npm/[email protected] None +8 92 kB mafintosh
npm/[email protected] environment +3 224 kB jonschlinkert
npm/[email protected] Transitive: eval +31 2.81 MB ljharb
npm/[email protected] Transitive: eval +16 328 kB ljharb
npm/[email protected] eval +7 665 kB medikoo
npm/[email protected] Transitive: eval +9 715 kB medikoo
npm/[email protected] filesystem 0 11.6 kB lukeed
npm/[email protected] None 0 3.79 kB sindresorhus
npm/[email protected] Transitive: environment, filesystem +8 297 kB ljharb
npm/[email protected] None +1 43.2 kB ljharb
npm/[email protected] filesystem, unsafe Transitive: environment, eval, shell +147 15.6 MB ljharb
npm/[email protected] Transitive: environment, filesystem +7 2.56 MB abandeali
npm/[email protected] Transitive: environment, eval, filesystem, shell, unsafe +100 11.1 MB mysticatea
npm/[email protected] None 0 24.7 kB eslintbot
npm/[email protected] filesystem Transitive: environment, eval, shell, unsafe +98 10.8 MB eslintbot
npm/[email protected] None +2 1.31 MB eslintbot
npm/[email protected] None 0 1 MB michaelficarra
npm/[email protected] None +1 112 kB medikoo
npm/[email protected] None +1 1.28 MB goto-bus-stop
npm/[email protected] filesystem +16 500 kB mrmlnc
npm/[email protected] None 0 39.7 kB matteo.collina
npm/[email protected] None +1 51.4 kB matteo.collina
npm/[email protected] filesystem Transitive: environment +14 257 kB royriojas
npm/[email protected] filesystem Transitive: environment +13 231 kB jaredwray
npm/[email protected] None 0 40.1 kB webreflection
npm/[email protected] eval +4 112 kB ljharb
npm/[email protected] filesystem Transitive: environment +10 145 kB isaacs
npm/[email protected] None +1 163 kB sindresorhus
npm/[email protected] filesystem +22 591 kB sindresorhus
npm/[email protected] None 0 10.9 kB ljharb
npm/[email protected] None +1 38.2 kB ljharb
npm/[email protected] None 0 3.02 kB tarruda
npm/[email protected] None +1 42.6 kB ljharb
npm/[email protected] None 0 6.8 kB feross
npm/[email protected] None 0 51.5 kB kael
npm/[email protected] Transitive: filesystem, unsafe +3 19.8 kB sindresorhus
npm/[email protected] None +2 264 kB beaugunderson
npm/[email protected] Transitive: eval +11 249 kB ljharb
npm/[email protected] None 0 14.8 kB ljharb
npm/[email protected] Transitive: eval +11 242 kB ljharb
npm/[email protected] None 0 28.9 kB ljharb
npm/[email protected] None +2 59 kB ljharb
npm/[email protected] None +1 19.8 kB phated
npm/[email protected] None 0 12.7 kB ljharb
npm/[email protected] None +2 60.4 kB ljharb
npm/[email protected] Transitive: eval +11 250 kB ljharb
npm/[email protected] None 0 12.3 kB ljharb
npm/[email protected] None +2 57.3 kB ljharb
npm/[email protected] None +1 42.6 kB ljharb
npm/[email protected] Transitive: eval +15 348 kB ljharb
npm/[email protected] Transitive: eval +10 218 kB ljharb
npm/[email protected] eval Transitive: environment, filesystem +3 757 kB vitaly
npm/[email protected] None 0 46.9 kB andyperlitch
npm/[email protected] None 0 9.87 kB npm-cli-ops
npm/[email protected] None 0 210 kB vscode-bot
npm/[email protected] None 0 5.93 kB angus-c
npm/[email protected] environment, network Transitive: filesystem +60 2.47 MB gar
npm/[email protected] None +5 244 kB jonschlinkert
npm/[email protected] None 0 54.5 kB ljharb
npm/[email protected] environment, network +7 648 kB gar
npm/[email protected] None +1 62.8 kB isaacs
npm/[email protected] None 0 5.71 kB mafintosh
npm/[email protected] None 0 7.65 kB medikoo
npm/[email protected] environment, eval +7 1.77 MB mrgnrdrck
npm/[email protected] environment, shell Transitive: filesystem, network +87 4.91 MB lukekarrys
npm/[email protected] None 0 97.2 kB ljharb
npm/[email protected] Transitive: eval +12 265 kB ljharb
npm/[email protected] Transitive: eval +12 315 kB ljharb
npm/[email protected] Transitive: eval +32 2.84 MB ljharb
npm/[email protected] None +5 151 kB gkz
npm/[email protected] Transitive: environment +12 267 kB cwmma
npm/[email protected] None 0 90 kB mrmlnc
npm/[email protected] None 0 5.21 kB lukekarrys
npm/[email protected] Transitive: eval +14 309 kB ljharb
npm/[email protected] None 0 302 kB mysticatea
npm/[email protected] None 0 6.56 kB feross
npm/[email protected] Transitive: eval +15 812 kB goto-bus-stop
npm/[email protected] None +2 125 kB npm-cli-ops
npm/[email protected] Transitive: eval +8 180 kB ljharb
npm/[email protected] None 0 45 kB ljharb
npm/[email protected] Transitive: eval +11 318 kB ljharb
npm/[email protected] None 0 4.62 kB feross
npm/[email protected] environment, eval +13 7.02 MB mrgnrdrck
npm/[email protected] None +4 48.7 kB sindresorhus
npm/[email protected] network +4 558 kB joshglazebrook
npm/[email protected] None +3 51.4 kB kemitchell
npm/[email protected] None 0 3.47 kB kemitchell
npm/[email protected] None +2 27.9 kB kemitchell
npm/[email protected] None 0 12.6 kB kemitchell
npm/[email protected] None +2 100 kB nlf
npm/[email protected] Transitive: network +6 93.7 kB jhiesey
npm/[email protected] None 0 4.46 kB mafintosh
npm/[email protected] Transitive: eval +31 2.81 MB ljharb
npm/[email protected] Transitive: eval +31 2.81 MB ljharb
npm/[email protected] Transitive: eval +31 2.81 MB ljharb
npm/[email protected] None +9 447 kB gajus-table
npm/[email protected] Transitive: environment, eval, filesystem +65 3.95 MB
npm/[email protected] environment, filesystem, unsafe +4 355 kB jonaskello
npm/[email protected] None +2 67.3 MB ajaff
npm/[email protected] None 0 111 kB sindresorhus
npm/[email protected] None 0 66.8 MB typescript-bot
npm/[email protected] None +2 18 kB lukekarrys
npm/[email protected] None +1 14.5 kB lukekarrys
npm/[email protected] None +1 101 kB ljharb
npm/[email protected] environment, filesystem, unsafe 0 14.9 kB yungsters
npm/[email protected] Transitive: environment, filesystem +5 1.14 MB aeschli
npm/[email protected] None 0 39.4 kB vscode-bot
npm/[email protected] None 0 260 kB dbaeumer
npm/[email protected] environment, filesystem 0 85.3 kB tylerl0706
npm/[email protected] None 0 65.6 kB jrieken
npm/[email protected] Transitive: eval +16 335 kB ljharb
npm/[email protected] Transitive: eval +14 324 kB ljharb

🚮 Removed packages: npm/@nodelib/[email protected], npm/@sinonjs/[email protected], npm/@sinonjs/[email protected], npm/@typescript-eslint/[email protected], npm/@typescript-eslint/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

socket-security[bot] avatar Jun 07 '23 16:06 socket-security[bot]

Hmm, I'll see if I can limit the dependencies above from being bumped.

mcmire avatar Jun 07 '23 16:06 mcmire

This PR was stale and outdated, so I rebased it.

mcmire avatar Nov 15 '23 21:11 mcmire

Merged changes from main. Ready for review again.

mcmire avatar Feb 13 '24 18:02 mcmire