[cryptodev-2s]

Replaces depcheck with knip like core, keeping the same ignores for dependencies that are used outside of imports.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	knip@​6.44.2

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	Potential security risk (AI signal): npm @emnapi/core is 66.0% likely risky Notes: This module is a wasm/N-API compatibility runtime with significant dynamic execution capabilities. The most serious findings are direct use of eval() in napi_run_script and use of new Function(...) in its function-wrapper generator. If any attacker can influence the script string or the function/identifier metadata reaching these paths (e.g., via a malicious wasm module, tampered worker messages, or untrusted inputs), it can enable arbitrary JavaScript execution in the host. No explicit credential theft, network exfiltration, or reverse-shell behavior is evident in the provided fragment, so the risk is primarily code-execution-driven rather than classic malware I/O. Confidence: 0.66 Severity: 0.70 From: package.json → npm/knip@6.44.2 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Potential security risk (AI signal): npm @oxc-resolver/binding-wasm32-wasi is 75.0% likely risky Notes: The JavaScript loader is a legitimate-looking WASI/N-API binding that synchronously instantiates and runs an opaque wasm binary. The immediate concerns are the privileges granted to the wasm: the loader passes the entire process.env to WASI and preopens the host filesystem root, giving the wasm potential access to environment secrets and the filesystem. Worker creation also forwards env and routes worker messages into wasm-controlled filesystem proxy functions. The JS code itself does not contain clear malware patterns, but because it executes an external wasm binary with broad privileges, this package carries a significant supply-chain risk if the wasm is malicious or tampered with. Recommend auditing the wasm binary (resolver.wasm32-wasi.wasm), removing or narrowing preopens, and avoiding passing full process.env to WASI/workers unless necessary. Confidence: 0.75 Severity: 0.70 From: package.json → npm/knip@6.44.2 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm formatly in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/knip@6.44.2 → npm/formatly@0.11.4 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/formatly@0.11.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm formatly in module child_process Module: child_process Location: Package overview From: package.json → npm/knip@6.44.2 → npm/formatly@0.11.4 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/formatly@0.11.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm oxc-parser in module child_process Module: child_process Location: Package overview From: package.json → npm/knip@6.44.2 → npm/oxc-parser@0.156.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.156.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm oxc-parser in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/knip@6.44.2 → npm/oxc-parser@0.156.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.156.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm oxc-resolver in module child_process Module: child_process Location: Package overview From: package.json → npm/knip@6.44.2 → npm/oxc-resolver@11.24.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-resolver@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	System shell access: npm oxc-resolver in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/knip@6.44.2 → npm/oxc-resolver@11.24.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-resolver@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Network access: npm @emnapi/core in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm @tybys/wasm-util in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@tybys/wasm-util@0.10.4 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @emnapi/core is 60.0% likely to have a medium risk anomaly Notes: The file package/dist/emnapi-core.min.js contains a wasm/N-API interop runtime that enables arbitrary JavaScript execution through eval in napi_run_script and dynamic function generation via new Function during wrapper creation. If attacker-controlled input reaches these dynamic paths (via unsafe wrapper code or a malicious WASM module), it can lead to remote code execution in the Node process and potentially in spawned workers. Confidence: 0.60 Severity: 0.70 From: package.json → npm/knip@6.44.2 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly Notes: Overall, this looks like a runtime/interop layer rather than overt malware. The key risk is that the module provides host-side dynamic code execution via napi_run_script (uses g.eval on a wasm-provided script string) and via emnapiCreateFunction (uses new Function). These are high-impact sinks if attacker-controlled data reaches them (e.g., untrusted wasm module or untrusted script/function name inputs). Without evidence of network/filesystem/credential theft in the shown code, malware likelihood is moderate, but security risk is elevated due to eval-like behavior. Confidence: 0.62 Severity: 0.58 From: package.json → npm/knip@6.44.2 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly Notes: No clear evidence of overt supply-chain malware (e.g., network exfiltration, filesystem/OS command execution, or credential theft) is present in the reviewed fragment. However, the module includes high-impact dynamic execution capabilities: an explicit eval-like API (napi_run_script uses g.eval) and dynamic function construction (new Function in emnapiCreateFunction). Combined with indirect wasm table calls and highly extensible import overrides, this creates a potentially serious security risk if any attacker can influence the script/function inputs or the import object/worker initialization payloads. Confidence: 0.62 Severity: 0.68 From: package.json → npm/knip@6.44.2 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @emnapi/core is 66.0% likely to have a medium risk anomaly Notes: This code fragment implements a WASM↔JS runtime bridge with async worker support and heavy marshalling. The dominant security concern is its high-impact dynamic execution capabilities: it directly calls eval() on a string obtained from WASM/handle storage (napi_run_script) and uses new Function(...) to construct wrappers from runtime-provided identifiers (re()). Additionally, it dynamically dispatches JS callbacks based on WASM-derived work/queue state. No explicit network exfiltration or credential theft is evident in the excerpt, but if a malicious/compromised WASM module can influence the evaluated strings or selected callbacks, the module can enable arbitrary code execution in the embedding environment. Require strong trust controls on the WASM artifact and constrain any path that can feed untrusted strings/identifiers into these sinks. Confidence: 0.66 Severity: 0.66 From: package.json → npm/knip@6.44.2 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @emnapi/core reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @emnapi/runtime reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@emnapi/runtime@1.11.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @emnapi/wasi-threads reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@emnapi/wasi-threads@1.2.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/wasi-threads@1.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @oxc-resolver/binding-wasm32-wasi is 90.0% likely to have a medium risk anomaly Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism. Confidence: 0.90 Severity: 0.60 From: package.json → npm/knip@6.44.2 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oxc-resolver/binding-wasm32-wasi Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oxc-resolver/binding-wasm32-wasi Env Vars: NAPI_RS_ASYNC_WORK_POOL_SIZE Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @oxc-resolver/binding-wasm32-wasi reads UV_THREADPOOL_SIZE Env Vars: UV_THREADPOOL_SIZE Location: Package overview From: package.json → npm/knip@6.44.2 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @tybys/wasm-util is 65.0% likely to have a medium risk anomaly Notes: No direct evidence of intentional malware, obfuscation-based payload hiding, or covert network exfiltration in this fragment. The primary security concerns are design/capability risks typical of WASI runtimes: executing externally provided WASM, high-impact filesystem access via injected fs/preopens, environment-variable exposure to the guest, possible host termination via proc_exit, and non-malicious operational risks (busy-wait timer handling and window.prompt stdin blocking; weak RNG fallback to Math.random). Risk is therefore configuration- and trust-boundary-dependent rather than a confirmed implant. Confidence: 0.65 Severity: 0.52 From: package.json → npm/knip@6.44.2 → npm/@tybys/wasm-util@0.10.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
See 22 more rows in the dashboard

View full report