@socketsecurity/cli 0.5.1 → 0.5.2

package/lib/shadow/bin/npm

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+require('../npm-cli.cjs')

package/lib/shadow/bin/npx

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+require('../npx-cli.cjs')

package/lib/shadow/global.d.ts

@@ -0,0 +1,3 @@
+declare module 'hyperlinker' {
+  export = (msg: string, href: URL['href']) => string
+}

package/lib/shadow/link.cjs

@@ -0,0 +1,43 @@
+/* eslint-disable no-console */
+const { chmodSync, realpathSync } = require('fs')
+const path = require('path')
+
+const which = require('which')
+
+/**
+ * @param {string} realDirname path to shadow/bin
+ * @param {'npm' | 'npx'} binname
+ * @returns {string} path to npm provided cli / npx bin
+ */
+function installLinks (realDirname, binname) {
+  const realNpmShadowBinDir = realDirname
+  // find npm being shadowed by this process
+  const npms = which.sync(binname, {
+    all: true
+  })
+  let shadowIndex = -1
+  const npmpath = npms.find((npmPath, i) => {
+    const isShadow = realpathSync(path.dirname(npmPath)) === realNpmShadowBinDir
+    if (isShadow) {
+      shadowIndex = i
+    }
+    return !isShadow
+  })
+  if (!npmpath) {
+    console.error('Socket unable to locate npm ensure it is available in the PATH environment variable')
+    process.exit(127)
+  }
+  if (shadowIndex === -1) {
+    chmodSync(realNpmShadowBinDir, parseInt('755', 8))
+    const bindir = path.join(realDirname)
+    process.env['PATH'] = `${
+      bindir
+    }${
+      process.platform === 'win32' ? ';' : ':'
+    }${
+      process.env['PATH']
+    }`
+  }
+  return npmpath
+}
+module.exports = installLinks

package/lib/shadow/npm-injection.cjs

@@ -0,0 +1,369 @@
+// THIS MUST BE CJS TO WORK WITH --require
+/* eslint-disable no-console */
+'use strict'
+
+const fs = require('fs')
+const path = require('path')
+const https = require('https')
+const events = require('events')
+const rl = require('readline')
+const oraPromise = import('ora')
+const isInteractivePromise = import('is-interactive')
+const chalkMarkdownPromise = import('../utils/chalk-markdown.js')
+
+const pubToken = 'sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api'
+
+// shadow `npm` and `npx` to mitigate subshells
+require('./link.cjs')(fs.realpathSync(path.join(__dirname, 'bin')), 'npm')
+
+/**
+ * @param {string[]} pkgids
+ * @returns {AsyncGenerator<{eco: string, pkg: string, ver: string } & ({type: 'missing'} | {type: 'success', value: { issues: any[] }})>}
+ */
+async function * batchScan (
+  pkgids
+) {
+  const query = {
+    packages: pkgids.map(pkgid => {
+      const delimiter = pkgid.lastIndexOf('@')
+      const name = pkgid.slice(0, delimiter)
+      const version = pkgid.slice(delimiter + 1)
+      return {
+        eco: 'npm', pkg: name, ver: version, top: true
+      }
+    })
+  }
+  const pkgDataReq = https.request(
+    'https://api.socket.dev/v0/scan/batch',
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Basic ${Buffer.from(`${pubToken}:`).toString('base64url')}`
+      }
+    }
+  ).end(
+    JSON.stringify(query)
+  )
+  const [res] = await events.once(pkgDataReq, 'response')
+  const isSuccess = res.statusCode === 200
+  if (!isSuccess) {
+    throw new Error('Socket API Error: ' + res.statusCode)
+  }
+  const rli = rl.createInterface(res)
+  for await (const line of rli) {
+    const result = JSON.parse(line)
+    yield result
+  }
+}
+
+/**
+ * @type {import('./translations.json') | null}
+ */
+let translations = null
+/**
+ * @type {import('../utils/chalk-markdown.js').ChalkOrMarkdown | null}
+ */
+let formatter = null
+
+const npmEntrypoint = fs.realpathSync(`${process.argv[1]}`)
+/**
+ * @param {string} filepath
+ * @returns {string}
+ */
+function findRoot (filepath) {
+  if (path.basename(filepath) === 'npm') {
+    return filepath
+  }
+  const parent = path.dirname(filepath)
+  if (parent === filepath) {
+    process.exit(127)
+  }
+  return findRoot(parent)
+}
+const npmDir = findRoot(path.dirname(npmEntrypoint))
+const arboristLibClassPath = path.join(npmDir, 'node_modules', '@npmcli', 'arborist', 'lib', 'arborist', 'index.js')
+/**
+ * @type {typeof import('@npmcli/arborist')}
+ */
+const Arborist = require(arboristLibClassPath)
+
+const kCtorArgs = Symbol('ctorArgs')
+const kRiskyReify = Symbol('riskyReify')
+class SafeArborist extends Arborist {
+  /**
+   * @param {ConstructorParameters<typeof Arborist>} ctorArgs
+   */
+  constructor (...ctorArgs) {
+    const mutedArguments = [{
+      ...(ctorArgs[0] ?? {}),
+      dryRun: true,
+      ignoreScripts: true,
+      save: false,
+      saveBundle: false,
+      audit: false,
+      // progress: false,
+      fund: false
+    }, ctorArgs.slice(1)]
+    super(...mutedArguments)
+    this[kCtorArgs] = ctorArgs
+  }
+
+  /**
+   * @param {Parameters<InstanceType<typeof Arborist>['reify']>} args
+   */
+  async [kRiskyReify] (...args) {
+    // safe arborist has suffered side effects and must be rebuilt from scratch
+    const arb = new Arborist(...this[kCtorArgs])
+    const ret = await arb.reify(...args)
+    Object.assign(this, arb)
+    return ret
+  }
+
+  /**
+   * @param {Parameters<InstanceType<typeof Arborist>['reify']>} args
+   * @override
+   */
+  async reify (...args) {
+    // @ts-expect-error types are wrong
+    if (args[0]?.dryRun) {
+      return this[kRiskyReify](...args)
+    }
+    args[0] ??= {}
+    const old = { ...args[0] }
+    // @ts-expect-error types are wrong
+    args[0].dryRun = true
+    args[0].save = false
+    args[0].saveBundle = false
+    // const originalDescriptors = Object.getOwnPropertyDescriptors(this)
+    // TODO: make this deal w/ any refactor to private fields by punching the class itself
+    await super.reify(...args)
+    const diff = gatherDiff(this)
+    // @ts-expect-error types are wrong
+    args[0].dryRun = old.dryRun
+    // @ts-expect-error types are wrong
+    args[0].save = old.save
+    // @ts-expect-error types are wrong
+    args[0].saveBundle = old.saveBundle
+    // nothing to check, mmm already installed?
+    if (diff.check.length === 0 && diff.unknowns.length === 0) {
+      return this[kRiskyReify](...args)
+    }
+    const isInteractive = (await isInteractivePromise).default()
+    if (isInteractive) {
+      const ora = (await oraPromise).default
+      const risky = await packagesHaveRiskyIssues(diff.check, ora)
+      if (risky) {
+        const rl = require('readline')
+        const rli = rl.createInterface(process.stdin, process.stderr)
+        while (true) {
+          /**
+           * @type {string}
+           */
+          const answer = await new Promise((resolve) => {
+            rli.question('Accept risks of installing these packages (y/N)? ', (str) => resolve(str))
+          })
+          if (/^\s*y(es)?\s*$/i.test(answer)) {
+            break
+          } else if (/^(\s*no?\s*|)$/i.test(answer)) {
+            throw new Error('Socket npm exiting due to risks')
+          }
+        }
+      }
+      return this[kRiskyReify](...args)
+    } else {
+      await packagesHaveRiskyIssues(diff.check)
+      throw new Error('Socket npm Unable to prompt to accept risk, need TTY to do so')
+    }
+  }
+}
+// @ts-ignore
+require.cache[arboristLibClassPath].exports = SafeArborist
+
+/**
+ * @param {InstanceType<typeof Arborist>} arb
+ * @returns {{
+ *   check: InstallEffect[],
+ *   unknowns: InstallEffect[]
+ * }}
+ */
+function gatherDiff (arb) {
+  // TODO: make this support private registry complexities
+  const registry = arb.registry
+  /**
+   * @type {InstallEffect[]}
+   */
+  const unknowns = []
+  /**
+   * @type {InstallEffect[]}
+   */
+  const check = []
+  for (const node of walk(arb.diff)) {
+    if (node.resolved?.startsWith(registry)) {
+      check.push(node)
+    } else {
+      unknowns.push(node)
+    }
+  }
+  return {
+    check,
+    unknowns
+  }
+}
+/**
+ * @typedef InstallEffect
+ * @property {import('@npmcli/arborist').Diff['action']} action
+ * @property {import('@npmcli/arborist').Node['pkgid'] | null} existing
+ * @property {import('@npmcli/arborist').Node['pkgid']} pkgid
+ * @property {import('@npmcli/arborist').Node['resolved']} resolved
+ * @property {import('@npmcli/arborist').Node['location']} location
+ */
+/**
+ * @param {import('@npmcli/arborist').Diff | null} diff
+ * @param {InstallEffect[]} needInfoOn
+ * @returns {InstallEffect[]}
+ */
+function walk (diff, needInfoOn = []) {
+  if (!diff) {
+    return needInfoOn
+  }
+
+  if (diff.action) {
+    const sameVersion = diff.actual?.package.version === diff.ideal?.package.version
+    let keep = false
+    let existing = null
+    if (diff.action === 'CHANGE') {
+      if (!sameVersion) {
+        existing = diff.actual.pkgid
+        keep = true
+      } else {
+        // console.log('SKIPPING META CHANGE ON', diff)
+      }
+    } else {
+      keep = diff.action !== 'REMOVE'
+    }
+    if (keep) {
+      if (diff.ideal?.pkgid) {
+        needInfoOn.push({
+          existing,
+          action: diff.action,
+          location: diff.ideal.location,
+          pkgid: diff.ideal.pkgid,
+          resolved: diff.ideal.resolved
+        })
+      }
+    }
+  }
+  if (diff.children) {
+    for (const child of diff.children) {
+      walk(child, needInfoOn)
+    }
+  }
+  return needInfoOn
+}
+
+/**
+ * @param {InstallEffect[]} pkgs
+ * @param {import('ora')['default'] | null} ora
+ * @returns {Promise<boolean>}
+ */
+async function packagesHaveRiskyIssues (pkgs, ora = null) {
+  let failed = false
+  if (pkgs.length) {
+    let remaining = pkgs.length
+    /**
+     *
+     * @returns {string}
+     */
+    function getText () {
+      return `Looking up data for ${remaining} packages`
+    }
+    const spinner = ora ? ora(getText()).start() : null
+    const pkgDatas = []
+    try {
+      for await (const pkgData of batchScan(pkgs.map(pkg => pkg.pkgid))) {
+        let failures = []
+        if (pkgData.type === 'missing') {
+          failures.push({
+            type: 'missingDependency'
+          })
+          continue
+        }
+        for (const issue of (pkgData.value?.issues ?? [])) {
+          if ([
+            'shellScriptOverride',
+            'gitDependency',
+            'httpDependency',
+            'installScripts',
+            'malware',
+            'didYouMean',
+            'hasNativeCode',
+            'troll',
+            'telemetry',
+            'invalidPackageJSON',
+            'unresolvedRequire',
+          ].includes(issue.type)) {
+            failures.push(issue)
+          }
+        }
+        // before we ask about problematic issues, check to see if they already existed in the old version
+        // if they did, be quiet
+        if (failures.length) {
+          const pkg = pkgs.find(pkg => pkg.pkgid === `${pkgData.pkg}@${pkgData.ver}` && pkg.existing?.startsWith(pkgData.pkg))
+          if (pkg?.existing) {
+            for await (const oldPkgData of batchScan([pkg.existing])) {
+              if (oldPkgData.type === 'success') {
+                failures = failures.filter(
+                  issue => oldPkgData.value.issues.find(oldIssue => oldIssue.type === issue.type) == null
+                )
+              }
+            }
+          }
+        }
+        if (failures.length) {
+          failed = true
+          spinner?.stop()
+          translations ??= JSON.parse(fs.readFileSync(path.join(__dirname, '/translations.json'), 'utf-8'))
+          formatter ??= new ((await chalkMarkdownPromise).ChalkOrMarkdown)(false)
+          const name = pkgData.pkg
+          const version = pkgData.ver
+          console.error(`${formatter.hyperlink(`${name}@${version}`, `https://socket.dev/npm/package/${name}/overview/${version}`)} contains risks:`)
+          if (translations) {
+            for (const failure of failures) {
+              const type = failure.type
+              if (type) {
+                // @ts-ignore
+                const issueTypeTranslation = translations.issues[type]
+                // TODO: emoji seems to misalign terminals sometimes
+                // @ts-ignore
+                const msg = `  ${issueTypeTranslation.title} - ${issueTypeTranslation.description}`
+                console.error(msg)
+              }
+            }
+          }
+          spinner?.start()
+        } else {
+          // TODO: have pacote/cacache download non-problematic files while waiting
+        }
+        remaining--
+        if (remaining !== 0) {
+          if (spinner) {
+            spinner.text = getText()
+          }
+        } else {
+          spinner?.stop()
+        }
+        pkgDatas.push(pkgData)
+      }
+      return failed
+    } finally {
+      if (spinner?.isSpinning) {
+        spinner?.stop()
+      }
+    }
+  } else {
+    if (ora) {
+      ora('').succeed('No changes detected')
+    }
+    return false
+  }
+}

package/lib/shadow/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/lib/shadow/translations.json

@@ -0,0 +1,689 @@
+{
+  "issueCategories": {
+    "license": {
+      "title": "License"
+    },
+    "maintenance": {
+      "title": "Maintenance"
+    },
+    "miscellaneous": {
+      "title": "Miscellaneous"
+    },
+    "quality": {
+      "title": "Quality"
+    },
+    "supplyChainRisk": {
+      "title": "Supply chain risk"
+    },
+    "vulnerability": {
+      "title": "Vulnerability"
+    }
+  },
+  "issueSeverity": {
+    "0": "Low",
+    "1": "Medium",
+    "2": "High",
+    "3": "Critical"
+  },
+  "issues": {
+    "badEncoding": {
+      "description": "Source files are encoded using a non-standard text encoding.",
+      "props": {
+        "encoding": "Encoding"
+      },
+      "suggestion": "Ensure all published files are encoded using a standard encoding such as UTF8, UTF16, UTF32, SHIFT-JIS, etc.",
+      "title": "Bad text encoding",
+      "emoji": "⚠️"
+    },
+    "badSemver": {
+      "description": "Package version is not a valid semantic version (semver).",
+      "suggestion": "All versions of all packages on npm should use use a valid semantic version. Publish a new version of the package with a valid semantic version. Semantic version ranges do not work with invalid semantic versions.",
+      "title": "Bad semver",
+      "emoji": "⚠️"
+    },
+    "badSemverDependency": {
+      "description": "Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.",
+      "props": {
+        "packageName": "Package name",
+        "packageVersion": "Package version"
+      },
+      "suggestion": "Switch to a version of the dependency with valid semver or override the dependency version if it is determined to be problematic.",
+      "title": "Bad dependency semver",
+      "emoji": "⚠️"
+    },
+    "bidi": {
+      "description": "Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.code for more information.",
+      "suggestion": "Remove bidirectional unicode control characters, or clearly document what they are used for.",
+      "title": "Bidirectional unicode control characters",
+      "emoji": "⚠️"
+    },
+    "binScriptConfusion": {
+      "description": "This package has multiple bin scripts with the same name.  This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack",
+      "props": {
+        "binScript": "Bin script"
+      },
+      "suggestion": "Consider removing one of the conflicting packages.  Packages should only export bin scripts with their name",
+      "title": "Bin script confusion",
+      "emoji": "😵‍💫"
+    },
+    "chronoAnomaly": {
+      "description": "Semantic versions published out of chronological order.",
+      "props": {
+        "prevChronoDate": "Previous chronological date",
+        "prevChronoVersion": "Previous chronological version",
+        "prevSemverDate": "Previous semver date",
+        "prevSemverVersion": "Previous semver version"
+      },
+      "suggestion": "This could either indicate dependency confusion or a patched vulnerability.",
+      "title": "Chronological version anomaly",
+      "emoji": "⚠️"
+    },
+    "criticalCVE": {
+      "description": "Contains a Critical Common Vulnerability and Exposure (CVE).",
+      "props": {
+        "id": "Id",
+        "severity": "Severity",
+        "title": "Title",
+        "url": "URL"
+      },
+      "suggestion": "Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.",
+      "title": "Critical CVE",
+      "emoji": "⚠️"
+    },
+    "cve": {
+      "description": "Contains a high severity Common Vulnerability and Exposure (CVE).",
+      "props": {
+        "id": "Id",
+        "severity": "Severity",
+        "title": "Title",
+        "url": "URL",
+        "vulnerable_versions": "Vulnerable versions"
+      },
+      "suggestion": "Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.",
+      "title": "CVE",
+      "emoji": "⚠️"
+    },
+    "debugAccess": {
+      "description": "Uses debug, reflection and dynamic code execution features.",
+      "props": {
+        "module": "Module"
+      },
+      "suggestion": "Removing the use of debug will reduce the risk of any reflection and dynamic code execution.",
+      "title": "Debug access",
+      "emoji": "⚠️"
+    },
+    "deprecated": {
+      "description": "The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.",
+      "props": {
+        "reason": "Reason"
+      },
+      "suggestion": "Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution.",
+      "title": "Deprecated",
+      "emoji": "⚠️"
+    },
+    "deprecatedException": {
+      "description": "Contains a known deprecated SPDX license exception.",
+      "props": {
+        "comments": "Comments",
+        "exceptionId": "Exception id"
+      },
+      "suggestion": "Fix the license so that it no longer contains deprecated SPDX license exceptions.",
+      "title": "Deprecated SPDX exception",
+      "emoji": "⚠️"
+    },
+    "deprecatedLicense": {
+      "description": "License is deprecated which may have legal implications regarding the package's use.",
+      "props": {
+        "licenseId": "License id"
+      },
+      "suggestion": "Update or change the license to a well-known or updated license.",
+      "title": "Deprecated license",
+      "emoji": "⚠️"
+    },
+    "didYouMean": {
+      "description": "Package name is similar to other popular packages and may not be the package you want.",
+      "props": {
+        "alternatePackage": "Alternate package",
+        "downloads": "Downloads",
+        "downloadsRatio": "Download ratio",
+        "editDistance": "Edit distance"
+      },
+      "suggestion": "Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.",
+      "title": "Potential typo squat",
+      "emoji": "🧐"
+    },
+    "dynamicRequire": {
+      "description": "Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.",
+      "suggestion": "Packages should avoid dynamic imports when possible. Audit the use of dynamic require to ensure it is not executing malicious or vulnerable code.",
+      "title": "Dynamic require",
+      "emoji": "⚠️"
+    },
+    "emptyPackage": {
+      "description": "Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.",
+      "props": {
+        "linesOfCode": "Lines of code"
+      },
+      "suggestion": "Remove dependencies that do not export any code or functionality and ensure the package version includes all of the files it is supposed to.",
+      "title": "Empty package",
+      "emoji": "⚠️"
+    },
+    "envVars": {
+      "description": "Package accesses environment variables, which may be a sign of credential stuffing or data theft.",
+      "props": {
+        "envVars": "Environment variables"
+      },
+      "suggestion": "Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.",
+      "title": "Environment variable access",
+      "emoji": "⚠️"
+    },
+    "extraneousDependency": {
+      "description": "Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.",
+      "props": {
+        "name": "Name"
+      },
+      "suggestion": "Specify all optionally loaded dependencies in optionalDependencies within package.json.",
+      "title": "Extraneous dependency",
+      "emoji": "⚠️"
+    },
+    "fileDependency": {
+      "description": "Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.",
+      "props": {
+        "filePath": "File path",
+        "packageName": "Package name"
+      },
+      "suggestion": "Remove the dependency specified by a file resolution string from package.json and update any bare name imports that referenced it before to use relative path strings.",
+      "title": "File dependency",
+      "emoji": "⚠️"
+    },
+    "filesystemAccess": {
+      "description": "Accesses the file system, and could potentially read sensitive data.",
+      "props": {
+        "module": "Module"
+      },
+      "suggestion": "If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.",
+      "title": "Filesystem access",
+      "emoji": "⚠️"
+    },
+    "gitDependency": {
+      "description": "Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.",
+      "props": {
+        "packageName": "Package name",
+        "url": "URL"
+      },
+      "suggestion": "Publish the git dependency to npm or a private package repository and consume it from there.",
+      "title": "Git dependency",
+      "emoji": "🍣"
+    },
+    "gitHubDependency": {
+      "description": "Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.",
+      "props": {
+        "commitsh": "Commit-ish (commit, branch, tag or version)",
+        "githubRepo": "Github repo",
+        "githubUser": "Github user",
+        "packageName": "Package name"
+      },
+      "suggestion": "Publish the GitHub dependency to npm or a private package repository and consume it from there.",
+      "title": "GitHub dependency",
+      "emoji": "⚠️"
+    },
+    "hasNativeCode": {
+      "description": "Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.",
+      "suggestion": "Ensure that native code bindings are expected. Consumers may consider pure JS and functionally similar alternatives to avoid the challenges and risks associated with native code bindings.",
+      "title": "Native code",
+      "emoji": "🫣"
+    },
+    "highEntropyStrings": {
+      "description": "Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.",
+      "suggestion": "Please inspect these strings to check if these strings are benign. Maintainers should clarify the purpose and existence of high entropy strings if there is a legitimate purpose.",
+      "title": "High entropy strings",
+      "emoji": "⚠️"
+    },
+    "homoglyphs": {
+      "description": "Contains unicode homoglyphs which can be used in supply chain confusion attacks.",
+      "suggestion": "Remove unicode homoglyphs if they are unnecessary, and audit their presence to confirm legitimate use.",
+      "title": "Unicode homoglyphs",
+      "emoji": "⚠️"
+    },
+    "httpDependency": {
+      "description": "Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.",
+      "props": {
+        "packageName": "Package name",
+        "url": "URL"
+      },
+      "suggestion": "Publish the HTTP URL dependency to npm or a private package repository and consume it from there.",
+      "title": "HTTP dependency",
+      "emoji": "🥩"
+    },
+    "installScripts": {
+      "description": "Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.",
+      "props": {
+        "script": "Script",
+        "source": "Source"
+      },
+      "suggestion": "Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.",
+      "title": "Install scripts",
+      "emoji": "📜"
+    },
+    "gptMalware": {
+      "description": "Artificial intelligence has determined that this package likely contains malicious behavior",
+      "props": {
+        "notes": "Does this contain malware?"
+      },
+      "suggestion": "Packages which contain malware should never be installed.  This package has been reported to npm for removal by socket",
+      "title": "AI detected malware",
+      "emoji": "🤖"
+    },
+    "invalidPackageJSON": {
+      "description": "Package has an invalid package.json and can cause installation problems if you try to use it.",
+      "suggestion": "Fix syntax errors in the invalid package.json and publish a new version with a valid package.json. Consumers can use npm overrides to force a version that does not have this problem if one exists.",
+      "title": "Invalid package.json",
+      "emoji": "🤒"
+    },
+    "invisibleChars": {
+      "description": "Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.",
+      "suggestion": "Remove invisible characters. If their use is justified, use their visible escaped counterparts.",
+      "title": "Invisible chars",
+      "emoji": "⚠️"
+    },
+    "licenseChange": {
+      "description": "Package license has recently changed.",
+      "props": {
+        "newLicenseId": "New license id",
+        "prevLicenseId": "Previous license id"
+      },
+      "suggestion": "License changes should be reviewed carefully to inform ongoing use. Packages should avoid making major changes to their license type.",
+      "title": "License change",
+      "emoji": "⚠️"
+    },
+    "licenseException": {
+      "description": "Contains an SPDX license exception.",
+      "props": {
+        "comments": "Comments",
+        "exceptionId": "Exception id"
+      },
+      "suggestion": "License exceptions should be carefully reviewed.",
+      "title": "License exception",
+      "emoji": "⚠️"
+    },
+    "longStrings": {
+      "description": "Contains long string literals, which may be a sign of obfuscated or packed code.",
+      "suggestion": "Avoid publishing or consuming obfuscated or bundled code. It makes dependencies difficult to audit and undermines the module resolution system.",
+      "title": "Long strings",
+      "emoji": "⚠️"
+    },
+    "missingTarball": {
+      "description": "This package is missing it's tarball.  It could be removed from the npm registry or there may have been an error when publishing.",
+      "suggestion": "This package cannot be analyzed or installed due to missing data.",
+      "title": "Missing package tarball",
+      "emoji": "❔"
+    },
+    "majorRefactor": {
+      "description": "Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.",
+      "props": {
+        "changedPercent": "Change percentage",
+        "curSize": "Current amount of lines",
+        "linesChanged": "Lines changed",
+        "prevSize": "Previous amount of lines"
+      },
+      "suggestion": "Consider waiting before upgrading to see if any issues are discovered, or be prepared to scrutinize any bugs or subtle changes the major refactor may bring. Publishers my consider publishing beta versions of major refactors to limit disruption to parties interested in the new changes.",
+      "title": "Major refactor",
+      "emoji": "⚠️"
+    },
+    "malware": {
+      "description": "This package is malware. We have asked npm to remove it.",
+      "props": {
+        "id": "Id",
+        "note": "Note"
+      },
+      "title": "Known Malware",
+      "suggestion": "It is strongly recommended that malware is removed from your codebase.",
+      "emoji": "☠️"
+    },
+    "mildCVE": {
+      "description": "Contains a low severity Common Vulnerability and Exposure (CVE).",
+      "props": {
+        "id": "Id",
+        "severity": "Severity",
+        "title": "Title",
+        "url": "URL"
+      },
+      "suggestion": "Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.",
+      "title": "Mild CVE",
+      "emoji": "⚠️"
+    },
+    "minifiedFile": {
+      "description": "This package contains minified code.  This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.",
+      "props": {
+        "confidence": "Confidence"
+      },
+      "suggestion": "In many cases minified code is harmless, however minified code can be used to hide a supply chain attack.  Consider not shipping minified code on npm.",
+      "title": "Minified code",
+      "emoji": "⚠️"
+    },
+    "missingAuthor": {
+      "description": "The package was published by an npm account that no longer exists.",
+      "suggestion": "Packages should have active and identified authors.",
+      "title": "Non-existent author",
+      "emoji": "🫥"
+    },
+    "missingDependency": {
+      "description": "A required dependency is not declared in package.json and may prevent the package from working.",
+      "props": {
+        "name": "Name"
+      },
+      "suggestion": "The package should define the missing dependency inside of package.json and publish a new version. Consumers may have to install the missing dependency themselves as long as the dependency remains missing. If the dependency is optional, add it to optionalDependencies and handle the missing case.",
+      "title": "Missing dependency",
+      "emoji": "⚠️"
+    },
+    "missingLicense": {
+      "description": "Package does not have a license and consumption legal status is unknown.",
+      "suggestion": "A new version of the package should be published that includes a valid SPDX license in a license file, pacakge.json license field or mentioned in the README.",
+      "title": "Missing license",
+      "emoji": "⚠️"
+    },
+    "mixedLicense": {
+      "description": "Package contains multiple licenses.",
+      "props": {
+        "licenseId": "License Id"
+      },
+      "suggestion": "A new version of the package should be published that includes a single license. Consumers may seek clarification from the package author. Ensure that the license details are consistent across the LICENSE file, package.json license field and license details mentioned in the README.",
+      "title": "Mixed license",
+      "emoji": "⚠️"
+    },
+    "modifiedException": {
+      "description": "Package contains a modified version of an SPDX license exception.  Please read carefully before using this code.",
+      "props": {
+        "comments": "Comments",
+        "exceptionId": "Exception id",
+        "similarity": "Similarity"
+      },
+      "suggestion": "Packages should avoid making modifications to standard license exceptions.",
+      "title": "Modified license exception",
+      "emoji": "⚠️"
+    },
+    "modifiedLicense": {
+      "description": "Package contains a modified version of an SPDX license.  Please read carefully before using this code.",
+      "props": {
+        "licenseId": "License id",
+        "similarity": "Similarity"
+      },
+      "suggestion": "Packages should avoid making modifications to standard licenses.",
+      "title": "Modified license",
+      "emoji": "⚠️"
+    },
+    "networkAccess": {
+      "description": "This module accesses the network.",
+      "props": {
+        "module": "Module"
+      },
+      "suggestion": "Packages should remove all network access that isn't functionally unnecessary. Consumers should audit network access to ensure legitimate use.",
+      "title": "Network access",
+      "emoji": "⚠️"
+    },
+    "newAuthor": {
+      "description": "A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.",
+      "props": {
+        "newAuthor": "New author",
+        "prevAuthor": "Previous author"
+      },
+      "suggestion": "Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.",
+      "title": "New author",
+      "emoji": "⚠️"
+    },
+    "noAuthorData": {
+      "description": "Package does not specify a list of contributors or an author in package.json.",
+      "suggestion": "Add a author field or contributors array to package.json.",
+      "title": "No contributors or author data",
+      "emoji": "⚠️"
+    },
+    "noBugTracker": {
+      "description": "Package does not have a linked bug tracker in package.json.",
+      "suggestion": "Add a bugs field to package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#bugs",
+      "title": "No bug tracker",
+      "emoji": "⚠️"
+    },
+    "noREADME": {
+      "description": "Package does not have a README. This may indicate a failed publish or a low quality package.",
+      "suggestion": "Add a README to to the package and publish a new version.",
+      "title": "No README",
+      "emoji": "⚠️"
+    },
+    "noRepository": {
+      "description": "Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.",
+      "suggestion": "Add a repository field to package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#repository",
+      "title": "No repository",
+      "emoji": "⚠️"
+    },
+    "noTests": {
+      "description": "Package does not have any tests. This is a strong signal of a poorly maintained or low quality package.",
+      "suggestion": "Add tests and publish a new version of the package. Consumers may look for an alternative package with better testing.",
+      "title": "No tests",
+      "emoji": "⚠️"
+    },
+    "noV1": {
+      "description": "Package is not semver >=1. This means it is not stable and does not support ^ ranges.",
+      "suggestion": "If the package sees any general use, it should begin releasing at version 1.0.0 or later to benefit from semver.",
+      "title": "No v1",
+      "emoji": "⚠️"
+    },
+    "noWebsite": {
+      "description": "Package does not have a website.",
+      "suggestion": "Add a homepage field to package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#homepage",
+      "title": "No website",
+      "emoji": "⚠️"
+    },
+    "nonFSFLicense": {
+      "description": "Package has a non-FSF-approved license.",
+      "props": {
+        "licenseId": "License id"
+      },
+      "title": "Non FSF license",
+      "emoji": "⚠️"
+    },
+    "nonOSILicense": {
+      "description": "Package has a non-OSI-approved license.",
+      "props": {
+        "licenseId": "License id"
+      },
+      "title": "Non OSI license",
+      "emoji": "⚠️"
+    },
+    "nonSPDXLicense": {
+      "description": "Package contains a non-standard license somewhere. Please read carefully before using.",
+      "suggestion": "Package should adopt a standard SPDX license consistently across all license locations (LICENSE files, package.json license fields, and READMEs).",
+      "title": "Non SPDX license",
+      "emoji": "⚠️"
+    },
+    "notice": {
+      "description": "Package contains a legal notice. This could increase your exposure to legal risk when using this project.",
+      "title": "Legal notice",
+      "emoji": "⚠️"
+    },
+    "obfuscatedFile": {
+      "description": "Obfuscated files are intentionally packed to hide their behavior.  This could be a sign of malware",
+      "props": {
+        "confidence": "Confidence"
+      },
+      "suggestion": "Packages should not obfuscate their code.  Consider not using packages with obfuscated code",
+      "title": "Obfuscated code",
+      "emoji": "⚠️"
+    },
+    "obfuscatedRequire": {
+      "description": "Package accesses dynamic properties of require and may be obfuscating code execution.",
+      "suggestion": "The package should not access dynamic properties of module. Instead use import or require directly.",
+      "title": "Obfuscated require",
+      "emoji": "⚠️"
+    },
+    "peerDependency": {
+      "description": "Package specifies peer dependencies in package.json.",
+      "props": {
+        "name": "Name"
+      },
+      "suggestion": "Peer dependencies are fragile and can cause major problems across version changes. Be careful when updating this dependency and its peers.",
+      "title": "Peer dependency",
+      "emoji": "⚠️"
+    },
+    "semverAnomaly": {
+      "description": "Package semver skipped several versions, this could indicate a dependency confusion attack or indicate the intention of disruptive breaking changes or major priority shifts for the project.",
+      "props": {
+        "newVersion": "New version",
+        "prevVersion": "Previous version"
+      },
+      "suggestion": "Packages should follow semantic versions conventions by not skipping subsequent version numbers. Consumers should research the purpose of the skipped version number.",
+      "title": "Semver anomaly",
+      "emoji": "⚠️"
+    },
+    "shellAccess": {
+      "description": "This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.",
+      "props": {
+        "module": "Module"
+      },
+      "suggestion": "Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.",
+      "title": "Shell access",
+      "emoji": "⚠️"
+    },
+    "shellScriptOverride": {
+      "description": "This package re-exports a well known shell command via an npm bin script.  This is possibly a supply chain attack",
+      "props": {
+        "binScript": "Bin script"
+      },
+      "suggestion": "Packages should not export bin scripts which conflict with well known shell commands",
+      "title": "Bin script shell injection",
+      "emoji": "🦀"
+    },
+    "suspiciousString": {
+      "description": "This package contains suspicious text patterns which are commonly associated with bad behavior",
+      "props": {
+        "explanation": "Explanation",
+        "pattern": "Pattern"
+      },
+      "suggestion": "The package code should be reviewed before installing",
+      "title": "Suspicious strings",
+      "emoji": "⚠️"
+    },
+    "telemetry": {
+      "description": "This package contains telemetry which tracks you.",
+      "props": {
+        "id": "Id",
+        "note": "Note"
+      },
+      "title": "Telemetry",
+      "emoji": "📞"
+    },
+    "trivialPackage": {
+      "description": "Packages less than 10 lines of code are easily copied into your own project and may not warrant the additional supply chain risk of an external dependency.",
+      "props": {
+        "linesOfCode": "Lines of code"
+      },
+      "suggestion": "Removing this package as a dependency and implementing its logic will reduce supply chain risk.",
+      "title": "Trivial Package",
+      "emoji": "⚠️"
+    },
+    "troll": {
+      "description": "This package is a joke, parody, or includes undocumented or hidden behavior unrelated to its primary function.",
+      "props": {
+        "id": "Id",
+        "note": "Note"
+      },
+      "title": "Protestware/Troll package",
+      "emoji": "🧌"
+    },
+    "typeModuleCompatibility": {
+      "description": "Package is CommonJS, but has a dependency which is type: \"module\".  The two are likely incompatible.",
+      "suggestion": "The package needs to switch to dynamic import on the esmodule dependency, or convert to esm itself. Consumers may experience errors resulting from this incompatibility.",
+      "title": "CommonJS depending on ESModule",
+      "emoji": "⚠️"
+    },
+    "uncaughtOptionalDependency": {
+      "description": "Package uses an optional dependency without handling a missing dependency exception. If you install it without the optional dependencies then it could cause runtime errors.",
+      "props": {
+        "name": "Name"
+      },
+      "suggestion": "Package should handle the loading of the dependency when it is not present, or convert the optional dependency into a regular dependency.",
+      "title": "Uncaught optional dependency",
+      "emoji": "⚠️"
+    },
+    "unclearLicense": {
+      "description": "Package contains a reference to a license without a matching LICENSE file.",
+      "props": {
+        "possibleLicenseId": "Possible license id"
+      },
+      "suggestion": "Add a LICENSE file that matches the license field in package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#license",
+      "title": "Unclear license",
+      "emoji": "⚠️"
+    },
+    "unmaintained": {
+      "description": "Package has not been updated in more than a year and may be unmaintained. Problems with the package may go unaddressed.",
+      "props": {
+        "lastPublish": "Last publish"
+      },
+      "suggestion": "Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.",
+      "title": "Unmaintained",
+      "emoji": "⚠️"
+    },
+    "unpublished": {
+      "description": "Package version was not found on the registry. It may exist on a different registry and need to be configured to pull from that registry.",
+      "props": {
+        "version": "The version that was not found"
+      },
+      "suggestion": "Packages can be removed from the registry by manually un-publishing, a security issue removal, or may simply never have been published to the registry. Reliance on these packages will cause problem when they are not found.",
+      "title": "Unpublished package",
+      "emoji": "⚠️"
+    },
+    "unresolvedRequire": {
+      "description": "Package imports a file which does not exist and may not work as is. It could also be importing a file that will be created at runtime which could be a vector for running malicious code.",
+      "suggestion": "Fix imports so that they require declared dependencies or existing files.",
+      "title": "Unresolved require",
+      "emoji": "🕵️"
+    },
+    "unsafeCopyright": {
+      "description": "Package contains a copyright but no license. Using this package may expose you to legal risk.",
+      "suggestion": "Clarify the license type by adding a license field to package.json and a LICENSE file.",
+      "title": "Unsafe copyright",
+      "emoji": "⚠️"
+    },
+    "unstableOwnership": {
+      "description": "A new collaborator has begun publishing package versions. Package stability and security risk may be elevated.",
+      "props": {
+        "author": "Author"
+      },
+      "suggestion": "Try to reduce the amount of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.",
+      "title": "Unstable ownership",
+      "emoji": "⚠️"
+    },
+    "unusedDependency": {
+      "description": "Package has unused dependencies. This package depends on code that it does not use.  This can increase the attack surface for malware and slow down installation.",
+      "props": {
+        "name": "Name",
+        "version": "Version"
+      },
+      "suggestion": "Packages should only specify dependencies that they use directly.",
+      "title": "Unused dependency",
+      "emoji": "⚠️"
+    },
+    "urlStrings": {
+      "description": "Package contains fragments of external URLs or IP addresses, which may indicate that it covertly exfiltrates data.",
+      "props": {
+        "urlFragment": "URL Fragment"
+      },
+      "suggestion": "Avoid using packages that make connections to the network, since this helps to leak data.",
+      "title": "URL strings",
+      "emoji": "⚠️"
+    },
+    "usesEval": {
+      "description": "Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.",
+      "props": {
+        "evalType": "Eval type"
+      },
+      "suggestion": "Avoid packages that use eval, since this could potentially execute any code.",
+      "title": "Uses eval",
+      "emoji": "⚠️"
+    },
+    "zeroWidth": {
+      "description": "Package files contain zero width unicode characters. This could indicate a supply chain attack.",
+      "suggestion": "Packages should remove unnecessary zero width unicode characters and use their visible counterparts.",
+      "title": "Zero width unicode chars",
+      "emoji": "⚠️"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/cli",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "CLI tool for Socket.dev",
   "homepage": "http://github.com/SocketDev/socket-cli-js",
   "repository": {
@@ -25,7 +25,10 @@
   },
   "files": [
     "cli.js",
-    "lib/**/*.js"
+    "lib/**/*.js",
+    "lib/**/*.json",
+    "lib/**/*.cjs",
+    "lib/shadow/**"
   ],
   "scripts": {
     "echo": "echo $PATH",