[cryptodev-2s]

Bumps the remaining dependencies to their latest versions, except the ones that went ESM only (octokit, ora, @metamask/utils) and the jest packages.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​lavamoat/​preinstall-always-fail@​1.0.0 ⏵ 3.0.1			+5	+6
	@​types/​luxon@​3.3.0 ⏵ 3.7.6
	unzipper@​0.12.3 ⏵ 0.12.5	+1		+1
	depcheck@​1.4.3 ⏵ 1.4.7			+1
	luxon@​3.3.0 ⏵ 3.7.2	+1		+1	-2
	ts-node@​10.9.1 ⏵ 10.9.2
	yaml@​2.9.0 ⏵ 2.9.1	+1
	csv-parse@​5.6.0 ⏵ 7.0.3	+1	+2	+1
	typescript@​5.1.3 ⏵ 6.0.3				+5
	simple-git@​3.27.0 ⏵ 4.0.2		+75		-2
	execa@​9.5.2 ⏵ 10.2.1	-1		+1	+10
	@​lavamoat/​allow-scripts@​2.3.1 ⏵ 5.1.0	+1			+7
	googleapis@​144.0.0 ⏵ 189.0.0	-3		+1	+1
	axios@​0.24.0 ⏵ 1.21.1	-1	+75	+1	+1
	@​slack/​web-api@​6.13.0 ⏵ 8.3.0	+1			-1
	@​slack/​webhook@​7.0.6 ⏵ 8.0.2				+8

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	Potential security risk (AI signal): npm @slack/web-api is 96.0% likely risky Notes: This is a Slack Web API client with a credential-exposure risk: its default bearer token is sent to any caller-supplied absolute URL when allowAbsoluteUrls is enabled (the default), and may also be sent to an external upload_url. The configured default API host is https://slack[.]com/api/; no suspicious hardcoded domains or malware behavior are evident. Severity is high if untrusted input can control the method URL or upload destination; otherwise the risk depends on caller and response trust boundaries. Confidence: 0.96 Severity: 0.74 From: package.json → npm/@slack/web-api@8.3.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@slack/web-api@8.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Network access: npm @simple-git/argv-parser in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/simple-git@4.0.2 → npm/@simple-git/argv-parser@2.0.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@simple-git/argv-parser@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm @slack/web-api in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@slack/web-api@8.3.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@slack/web-api@8.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm @slack/webhook in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@slack/webhook@8.0.2 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@slack/webhook@8.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm formdata-polyfill in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/googleapis@189.0.0 → npm/formdata-polyfill@4.0.10 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/formdata-polyfill@4.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm google-auth-library in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/googleapis@189.0.0 → npm/google-auth-library@11.3.4 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/google-auth-library@11.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm google-auth-library in module https Module: https Location: Package overview From: package.json → npm/googleapis@189.0.0 → npm/google-auth-library@11.3.4 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/google-auth-library@11.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Medium CVE: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal CVE: GHSA-3g3m-2fjr-6pw4 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal (MODERATE) Affected versions: >= 9.0.0 < 14.0.2 Patched version: 14.0.2 From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/glob@13.0.7 ℹ Read more on: This package | This alert | What is a medium CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@13.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Medium CVE: npm minimatch has potential denial of service via globparts amplification CVE: GHSA-g3hv-75wg-m249 minimatch has potential denial of service via globparts amplification (MODERATE) Affected versions: >= 7.0.0 < 11.0.1 Patched version: 11.0.1 From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/minimatch@10.2.6 ℹ Read more on: This package | This alert | What is a medium CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@10.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Medium CVE: npm minimatch has potential denial of service via globparts amplification CVE: GHSA-g3hv-75wg-m249 minimatch has potential denial of service via globparts amplification (MODERATE) Affected versions: >= 7.0.0 < 11.0.1 Patched version: 11.0.1 From: package.json → npm/depcheck@1.4.7 → npm/minimatch@7.4.9 ℹ Read more on: This package | This alert | What is a medium CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@7.4.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential security risk (AI signal): npm depcheck is 76.0% likely risky Notes: No explicit malicious payload or data-exfiltration behavior is present in this fragment. However, it exposes high-impact primitives: (1) execution of caller-supplied JavaScript via vm.runInNewContext and (2) dynamic module loading via require(filePath) where “JSON” is loaded using require rather than JSON parsing. Additionally, dynamic dependency resolution/loading is possible via tryRequire with caller-controlled module specifiers and resolution paths. If any of the inputs (code, filePath, moduleName, rootDir, module, paths) can be influenced by an attacker, this module can enable arbitrary code execution or unintended dependency loading. Strict upstream trust boundaries, allowlists, and path/module validation are required. Confidence: 0.76 Severity: 0.78 From: package.json → npm/depcheck@1.4.7 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/depcheck@1.4.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Install-time scripts: npm @lavamoat/preinstall-always-fail during preinstall Install script: preinstall Source: echo "Don't run npm lifecycle scripts by default! Use @lavamoat.harden to configure the project. (The presence of preinstall-always-fail might mean a secure configuration existed and was corrupted)" && exit 1 From: package.json → npm/@lavamoat/preinstall-always-fail@3.0.1 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lavamoat/preinstall-always-fail@3.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm glob in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/glob@13.0.7 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@13.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm google-auth-library is 75.0% likely to have a medium risk anomaly Notes: The PluggableAuthClient at package/build/src/auth/pluggable-auth-client.js retrieves tokens by running a user-specified external executable with environment gates, timeout bounds, and output validation. This design expands the trusted code surface and can lead to arbitrary tokens or data leakage, especially via the external process and a file-based cache. Mitigations include restricting executable sources, securing and validating the output cache, enforcing strict file permissions, auditing executable usage, and operating within controlled environments. Confidence: 0.75 Severity: 0.60 From: package.json → npm/googleapis@189.0.0 → npm/google-auth-library@11.3.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/google-auth-library@11.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm google-auth-library is 70.0% likely to have a medium risk anomaly Notes: This module is essentially an external-process execution and JSON parsing/caching wrapper. It contains no obvious malicious payload in the snippet, but it has substantial security risk because it can (1) spawn a dynamically configured executable without allowlisting/sandboxing, (2) merge caller-controlled envMap into the child process environment, and (3) read and parse a configurable local outputFile path for cached JSON. If any of options.command, envMap, or outputFile are attacker-influenced, the risk shifts from integration risk to potentially high-impact (arbitrary command execution and/or sensitive file disclosure through cached reads). Confidence: 0.70 Severity: 0.66 From: package.json → npm/googleapis@189.0.0 → npm/google-auth-library@11.3.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/google-auth-library@11.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm google-auth-library is 75.0% likely to have a medium risk anomaly Notes: The code reflects a conventional, legitimate Google ID Token client implementation. There are no signs of malicious behavior such as data exfiltration, backdoors, or hidden I/O within this fragment. Primary risks stem from external dependencies (idTokenProvider) and environmental compatibility for the Fetch API Headers. Overall, low to moderate security risk for this isolated fragment with attention to provider trust and runtime environment. Confidence: 0.75 Severity: 0.50 From: package.json → npm/googleapis@189.0.0 → npm/google-auth-library@11.3.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/google-auth-library@11.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm googleapis-common is 68.0% likely to have a medium risk anomaly Notes: This module is not obviously malicious, but it is security-sensitive: it accepts caller-influenced discovery and schema locations that can lead to outbound HTTP requests to attacker-controlled URLs (SSRF-style capability) and local file reads from arbitrary paths when non-http(s) strings are provided (LFI-style capability). It then applies untrusted schema data through Endpoint.applySchema, which could amplify impact depending on downstream implementation. Strong input validation/allowlisting and sandboxing around URL/file handling would be important for safe use. Confidence: 0.68 Severity: 0.63 From: package.json → npm/googleapis@189.0.0 → npm/googleapis-common@9.3.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/googleapis-common@9.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm simple-git Location: Package overview From: package.json → npm/simple-git@4.0.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/simple-git@4.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm undici in module node:http Module: node:http Location: Package overview From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm undici in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm undici in module node:net Module: node:net Location: Package overview From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm undici in module node:tls Module: node:tls Location: Package overview From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm undici in module node:http2 Module: node:http2 Location: Package overview From: package.json → npm/@lavamoat/allow-scripts@5.1.0 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
See 54 more rows in the dashboard

View full report