chore: replace depcheck with knip

[cryptodev-2s]

Core dropped depcheck for knip, so match it. Sits below the Node bump so it lands with the rest of the tooling alignment.

	Before	After
dependency linter	depcheck@^1.4.7 + .depcheckrc.json	knip@^6.23.0 + knip.config.mts

Scripts follow core's shape: lint:dependencies bakes in yarn dedupe --check, with a separate lint:dependencies:fix for the writing form, rather than threading --check through from lint.

Config is nine lines, not core's 292

Core's knip.config.mts is almost entirely per-workspace tuning for a monorepo. This is a single package, so it needs an entry pair and two ignores:

entry: ['src/index.ts', 'src/node.ts'],
project: ['src/**/*.ts'],
ignoreDependencies: ['@lavamoat/allow-scripts', '@lavamoat/preinstall-always-fail'],

Both lavamoat packages are wired in through the Yarn plugin and the lavamoat.allowScripts field rather than imported, so knip can't see the usage.

It found dead weight depcheck was hiding

The old .depcheckrc.json ignore list included ts-node. Nothing references it: it isn't a peer of ts-jest, appears nowhere outside its own package.json entry, and core doesn't carry it. Removed rather than re-ignored.

Node requirement

knip needs ^20.19.0 || >=22.12.0. Only the Lint job runs it and that job is pinned to 22.x, so this is safe ahead of the Node floor bump in the next PR.

---

Note

Low Risk
Dev-only lint and dependency tooling changes; no runtime or published package behavior.

Overview
Replaces depcheck with knip for dependency linting, aligned with MetaMask core tooling.

.depcheckrc.json is removed and knip.config.mts is added with entries src/index.ts and src/node.ts, plus ignoreDependencies for the two Lavamoat packages that are referenced via Yarn/Lavamoat config rather than imports.

lint:dependencies now runs knip --config knip.config.mts --dependencies followed by yarn dedupe --check (check-only in CI). A new lint:dependencies:fix runs the same knip step with a writable yarn dedupe, and lint:fix points at that script instead of the old --check threading on depcheck.

depcheck and unused ts-node are dropped from devDependencies; the lockfile reflects knip’s dependency tree (and prunes depcheck/ts-node-related packages).

^{Reviewed by Cursor Bugbot for commit 9409f44. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	knip@​6.34.0

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential security risk (AI signal): npm @emnapi/core is 66.0% likely risky Notes: This module is a wasm/N-API compatibility runtime with significant dynamic execution capabilities. The most serious findings are direct use of eval() in napi_run_script and use of new Function(...) in its function-wrapper generator. If any attacker can influence the script string or the function/identifier metadata reaching these paths (e.g., via a malicious wasm module, tampered worker messages, or untrusted inputs), it can enable arbitrary JavaScript execution in the host. No explicit credential theft, network exfiltration, or reverse-shell behavior is evident in the provided fragment, so the risk is primarily code-execution-driven rather than classic malware I/O. Confidence: 0.66 Severity: 0.70 From: package.json → npm/knip@6.34.0 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm @oxc-resolver/binding-wasm32-wasi is 75.0% likely risky Notes: The JavaScript loader is a legitimate-looking WASI/N-API binding that synchronously instantiates and runs an opaque wasm binary. The immediate concerns are the privileges granted to the wasm: the loader passes the entire process.env to WASI and preopens the host filesystem root, giving the wasm potential access to environment secrets and the filesystem. Worker creation also forwards env and routes worker messages into wasm-controlled filesystem proxy functions. The JS code itself does not contain clear malware patterns, but because it executes an external wasm binary with broad privileges, this package carries a significant supply-chain risk if the wasm is malicious or tampered with. Recommend auditing the wasm binary (resolver.wasm32-wasi.wasm), removing or narrowing preopens, and avoiding passing full process.env to WASI/workers unless necessary. Confidence: 0.75 Severity: 0.70 From: package.json → npm/knip@6.34.0 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm formatly in module child_process Module: child_process Location: Package overview From: package.json → npm/knip@6.34.0 → npm/formatly@0.7.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/formatly@0.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm oxc-parser in module child_process Module: child_process Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-parser@0.147.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.147.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm oxc-parser in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-parser@0.147.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.147.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm oxc-resolver in module child_process Module: child_process Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-resolver@11.24.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-resolver@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm oxc-resolver in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-resolver@11.24.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-resolver@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 60.0% likely to have a medium risk anomaly Notes: The file package/dist/emnapi-core.min.js contains a wasm/N-API interop runtime that enables arbitrary JavaScript execution through eval in napi_run_script and dynamic function generation via new Function during wrapper creation. If attacker-controlled input reaches these dynamic paths (via unsafe wrapper code or a malicious WASM module), it can lead to remote code execution in the Node process and potentially in spawned workers. Confidence: 0.60 Severity: 0.70 From: package.json → npm/knip@6.34.0 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly Notes: Overall, this looks like a runtime/interop layer rather than overt malware. The key risk is that the module provides host-side dynamic code execution via napi_run_script (uses g.eval on a wasm-provided script string) and via emnapiCreateFunction (uses new Function). These are high-impact sinks if attacker-controlled data reaches them (e.g., untrusted wasm module or untrusted script/function name inputs). Without evidence of network/filesystem/credential theft in the shown code, malware likelihood is moderate, but security risk is elevated due to eval-like behavior. Confidence: 0.62 Severity: 0.58 From: package.json → npm/knip@6.34.0 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly Notes: No clear evidence of overt supply-chain malware (e.g., network exfiltration, filesystem/OS command execution, or credential theft) is present in the reviewed fragment. However, the module includes high-impact dynamic execution capabilities: an explicit eval-like API (napi_run_script uses g.eval) and dynamic function construction (new Function in emnapiCreateFunction). Combined with indirect wasm table calls and highly extensible import overrides, this creates a potentially serious security risk if any attacker can influence the script/function inputs or the import object/worker initialization payloads. Confidence: 0.62 Severity: 0.68 From: package.json → npm/knip@6.34.0 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 66.0% likely to have a medium risk anomaly Notes: This code fragment implements a WASM↔JS runtime bridge with async worker support and heavy marshalling. The dominant security concern is its high-impact dynamic execution capabilities: it directly calls eval() on a string obtained from WASM/handle storage (napi_run_script) and uses new Function(...) to construct wrappers from runtime-provided identifiers (re()). Additionally, it dynamically dispatches JS callbacks based on WASM-derived work/queue state. No explicit network exfiltration or credential theft is evident in the excerpt, but if a malicious/compromised WASM module can influence the evaluated strings or selected callbacks, the module can enable arbitrary code execution in the embedding environment. Require strong trust controls on the WASM artifact and constrain any path that can feed untrusted strings/identifiers into these sinks. Confidence: 0.66 Severity: 0.66 From: package.json → npm/knip@6.34.0 → npm/@emnapi/core@1.11.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.11.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @oxc-resolver/binding-wasm32-wasi is 90.0% likely to have a medium risk anomaly Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism. Confidence: 0.90 Severity: 0.60 From: package.json → npm/knip@6.34.0 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @oxc-resolver/binding-wasm32-wasi Location: Package overview From: package.json → npm/knip@6.34.0 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @oxc-resolver/binding-wasm32-wasi Env Vars: NAPI_RS_ASYNC_WORK_POOL_SIZE Location: Package overview From: package.json → npm/knip@6.34.0 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @oxc-resolver/binding-wasm32-wasi reads UV_THREADPOOL_SIZE Env Vars: UV_THREADPOOL_SIZE Location: Package overview From: package.json → npm/knip@6.34.0 → npm/@oxc-resolver/binding-wasm32-wasi@11.24.2 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm jiti is 68.0% likely to have a medium risk anomaly Notes: The fragment implements a sophisticated on-the-fly loader using JITI for transpilation and execution, with careful handling of JSON interop based on nearby package.json type. There is no explicit malicious behavior identified (no external network activity, no hardcoded secrets). However, the dynamic code execution path introduced by _wrapSource and the synthetic module environment represents a potential risk vector if untrusted inputs are loaded, or if jiti/mjs execution context could be manipulated. This warrants strict review of the loader environment, the version and security of JITI, and checks on the sources being loaded to mitigate potential code execution or supply chain concerns. Confidence: 0.68 Severity: 0.60 From: package.json → npm/eslint@9.39.5 → npm/knip@6.34.0 → npm/jiti@2.7.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jiti@2.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm jiti Location: Package overview From: package.json → npm/eslint@9.39.5 → npm/knip@6.34.0 → npm/jiti@2.7.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jiti@2.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm jiti reads TMPDIR Env Vars: TMPDIR Location: Package overview From: package.json → npm/eslint@9.39.5 → npm/knip@6.34.0 → npm/jiti@2.7.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jiti@2.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm jiti reads JITI_RESPECT_TMPDIR_ENV Env Vars: JITI_RESPECT_TMPDIR_ENV Location: Package overview From: package.json → npm/eslint@9.39.5 → npm/knip@6.34.0 → npm/jiti@2.7.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jiti@2.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm oxc-parser is 80.0% likely to have a medium risk anomaly Notes: The module installs a binding package at runtime via pnpm into a predictable location and requires it during module load, performing network installation without integrity checks. This creates a supply-chain and remote-code-execution risk if an attacker can tamper with the registry, the package, or the installation path. Mitigations include removing runtime installs from require-time, preinstalling bindings during CI/install, validating integrity, and avoiding writable temporary directories or ensuring atomic installations. Confidence: 0.80 Severity: 0.70 From: package.json → npm/knip@6.34.0 → npm/oxc-parser@0.147.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.147.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm oxc-parser reads NAPI_RS_NATIVE_LIBRARY_PATH Env Vars: NAPI_RS_NATIVE_LIBRARY_PATH Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-parser@0.147.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.147.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm oxc-parser Env Vars: NAPI_RS_ENFORCE_VERSION_CHECK Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-parser@0.147.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.147.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm oxc-parser reads NAPI_RS_WASI_FLAVOR Env Vars: NAPI_RS_WASI_FLAVOR Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-parser@0.147.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.147.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm oxc-parser reads NAPI_RS_FORCE_WASI Env Vars: NAPI_RS_FORCE_WASI Location: Package overview From: package.json → npm/knip@6.34.0 → npm/oxc-parser@0.147.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxc-parser@0.147.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 10 more rows in the dashboard

View full report