socket.io-client
Realtime application framework client
51
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
rauchgdarrachequesne
Keywords
realtimeframeworkwebsockettcpeventsclient
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/socket.io.msgpack.min.js | AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library. | ai | |
| dependencies | unvetted-dep:bind | AI (dependencies): bind is a legitimate utility library; package's 5419-day history and ecosystem trust justify acceptance. | ai | |
| dependencies | unvetted-dep:has-binary-data | AI (dependencies): has-binary-data is a legitimate utility; stable dependency for this mature package. | ai | |
| source-diff | net-exec-file:dist/socket.io.min.js | AI (source-diff): Webpack UMD bundle of socket.io-client for browser use; network calls + Function('return this') are expected for a WebSocket client library. | ai | |
| source-diff | net-exec-file:dist/socket.io.slim.min.js | AI (source-diff): Minified webpack bundle; network+execution pattern is expected for WebSocket client code, not malware. | ai | |
| phantom-deps | phantom-dep:object-component | AI (phantom-deps): object-component is a legitimate dependency used in bundled client libraries; phantom-dep pattern is stable for socket.io-client. | ai | |
| dependencies | unvetted-dep:has-binary | AI (dependencies): has-binary is a legitimate utility dependency; no security concern for socket.io-client. | ai | |
| dependencies | unvetted-dep:active-x-obfuscator | AI (dependencies): active-x-obfuscator is a legitimate utility for IE ActiveX string obfuscation, appropriate for a cross-browser socket library. Its use here is consistent with socket.io-client's documented browser support goals. | ai | |
| dependencies | unvetted-dep:component-bind | AI (dependencies): component-bind is a long-standing micro-utility in the Socket.IO/Component ecosystem; stable false positive for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): darrachequesne is the documented primary Socket.IO maintainer; this is a legitimate maintainer addition, not a takeover. | ai | |
| source-diff | net-exec-file:dist/socket.io.js | AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware. | ai | |
| provenance | publisher-changed | AI (provenance): darrachequesne is the documented primary Socket.IO maintainer since 2017; transition from rauchg is a well-known legitimate handoff within Automattic. | ai | |
| source-diff | obfuscated-file:dist/socket.io.js | AI (source-diff): Standard webpack browser bundle for socket.io-client; minified output is expected and documented for this package's dist/ directory. | ai | |
| source-diff | net-exec-file:dist/socket.io.dev.js | AI (source-diff): Standard webpack UMD browser bundle for a WebSocket networking library. Network calls and module loading are core functionality, not malware indicators. | ai | |
| source-diff | net-exec-file:dist/socket.io.slim.dev.js | AI (source-diff): Standard webpack UMD browser bundle (slim variant). Network calls and module loading are core functionality, not malware indicators. | ai | |
| source-diff | net-exec-file:dist/socket.io.slim.js | AI (source-diff): Webpack-bundled client library; network+execution pattern is expected for WebSocket client code, not malware. | ai | |
| source-diff | obfuscated-file:dist/socket.io.slim.js | AI (source-diff): Standard webpack slim browser bundle for socket.io-client; minified output is expected for this package's dist/ directory. | ai | |
| npm-metadata | url-dep:bind | AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk. | ai | |
| npm-metadata | url-dep:emitter | AI (npm-metadata): URL dependency to GitHub archive is legitimate for this 2014-era package; trusted publisher mitigates risk. | ai | |
| source-diff | obfuscated-file:coverage/lcov-report/prettify.js | AI (source-diff): Google Code Prettify syntax highlighter included in Istanbul coverage reports; well-known minified file, entirely benign. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is used for JSON parsing in bundled code; standard and safe pattern. | ai | |
| source-diff | net-exec-file:socket.io.js | AI (source-diff): Browserified socket.io client bundle; network + code execution is expected for WebSocket client library. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is within browserified bundle; expected and safe in build output. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in lib/json.js is part of a bundled JSON2/Crockford parser — a well-known legitimate pattern for JSON parsing in older environments. Not a supply-chain indicator. | ai | |
| phantom-deps | phantom-dep:@types/component-emitter | AI (phantom-deps): @types/component-emitter is intentionally listed as a runtime dep for type resolution in this package; stable false positive for socket.io-client. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation was not standard practice in 2014; metadata signal only. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All 11 new dependencies are established utility packages appropriate for WebSocket client; no suspicious additions. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large number of new files reflects the addition of ESM build artifacts and restructured build pipeline, consistent with the version diff showing new build/compile scripts. | ai | |
| source-diff | net-exec-file:dist/socket.io.esm.min.js | AI (source-diff): socket.io-client legitimately ships minified browser bundles with network calls and cross-env global accessors (Function('return this')). This is expected build output, not malware. | ai | |
| dependencies | unvetted-dep:engine.io-client | AI (dependencies): engine.io-client is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client. | ai | |
| dependencies | unvetted-dep:socket.io-parser | AI (dependencies): socket.io-parser is an official Socket.IO sub-package from the same monorepo; it is an expected and legitimate dependency of socket.io-client. | ai |
Versions (showing 51 of 119)
| Version | Deps | Published |
|---|---|---|
| 4.8.3 | 4 / 0 | |
| 4.8.2 | 4 / 0 | |
| 4.8.1 | 4 / 0 | |
| 4.8.0 | 4 / 0 | |
| 4.7.5 | 4 / 35 | |
| 4.7.4 | 4 / 35 | |
| 4.7.3 | 4 / 35 | |
| 4.7.2 | 4 / 35 | |
| 4.7.1 | 4 / 35 | |
| 4.7.0 | 4 / 35 | |
| 4.6.2 | 4 / 35 | |
| 4.6.1 | 4 / 35 | |
| 4.6.0 | 4 / 35 | |
| 4.5.4 | 4 / 35 | |
| 4.5.3 | 4 / 37 | |
| 4.5.2 | 4 / 37 | |
| 4.5.1 | 4 / 37 | |
| 4.5.0 | 4 / 37 | |
| 4.4.1 | 6 / 37 | |
| 4.4.0 | 6 / 37 | |
| 4.3.2 | 6 / 37 | |
| 4.3.1 | 6 / 37 | |
| 4.3.0 | 6 / 37 | |
| 4.2.0 | 7 / 31 | |
| 4.1.3 | 7 / 29 | |
| 4.1.2 | 7 / 32 | |
| 4.1.1 | 7 / 32 | |
| 4.1.0 | 7 / 32 | |
| 4.0.2 | 7 / 32 | |
| 4.0.1 | 7 / 32 | |
| 4.0.0 | 7 / 32 | |
| 3.1.3 | 7 / 31 | |
| 3.1.2 | 7 / 31 | |
| 3.1.1 | 7 / 31 | |
| 3.1.0 | 7 / 31 | |
| 3.0.5 | 7 / 31 | |
| 3.0.4 | 8 / 31 | |
| 3.0.3 | 8 / 31 | |
| 3.0.2 | 8 / 30 | |
| 3.0.1 | 8 / 30 | |
| 3.0.0 | 8 / 30 | |
| 2.5.0 | 11 / 29 | |
| 2.4.0 | 11 / 29 | |
| 2.3.1 | 11 / 29 | |
| 2.3.0 | 14 / 27 | |
| 2.2.0 | 14 / 27 | |
| 2.1.1 | 14 / 27 | |
| 2.1.0 | 14 / 27 | |
| 2.0.4 | 13 / 25 | |
| 2.0.3 | 13 / 25 | |
| 2.0.2 | 13 / 25 |