chore: replace depcheck with knip by cryptodev-2s · Pull Request #330 · MetaMask/utils

cryptodev-2s · 2026-09-09T11:47:21Z

Core dropped depcheck for knip, so match it. Sits below the Node bump so it lands with the rest of the tooling alignment.

	Before	After
dependency linter	`depcheck@^1.4.7` + `.depcheckrc.json`	`knip@^6.23.0` + `knip.config.mts`

Scripts follow core's shape: lint:dependencies bakes in yarn dedupe --check, with a separate lint:dependencies:fix for the writing form, rather than threading --check through from lint.

Config is nine lines, not core's 292

Core's knip.config.mts is almost entirely per-workspace tuning for a monorepo. This is a single package, so it needs an entry pair and two ignores:

entry: ['src/index.ts', 'src/node.ts'],
project: ['src/**/*.ts'],
ignoreDependencies: ['@lavamoat/allow-scripts', '@lavamoat/preinstall-always-fail'],

Both lavamoat packages are wired in through the Yarn plugin and the lavamoat.allowScripts field rather than imported, so knip can't see the usage.

It found dead weight depcheck was hiding

The old .depcheckrc.json ignore list included ts-node. Nothing references it: it isn't a peer of ts-jest, appears nowhere outside its own package.json entry, and core doesn't carry it. Removed rather than re-ignored.

Node requirement

knip needs ^20.19.0 || >=22.12.0. Only the Lint job runs it and that job is pinned to 22.x, so this is safe ahead of the Node floor bump in the next PR.

Note

Low Risk
Tooling-only change to dependency linting; no runtime or library API changes.

Overview
Replaces depcheck and .depcheckrc.json with knip and a small knip.config.mts that scopes analysis to src/index.ts, src/node.ts, and src/**/*.ts, while ignoring Lavamoat packages that are referenced only via Yarn/Lavamoat config.

Lint scripts now run knip --dependencies plus yarn dedupe --check under lint:dependencies, with a new lint:dependencies:fix (and lint:fix wired to it) that runs dedupe without --check.

Dev dependencies: adds knip@^6.23.0, removes depcheck and unused ts-node (previously on depcheck’s ignore list). Lockfile updates reflect knip’s dependency tree and shed depcheck/ts-node transitives.

^{Reviewed by Cursor Bugbot for commit 9cecd71. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-09-09T11:48:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	knip@6.34.0

View full report

socket-security · 2026-09-09T11:48:05Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Potential security risk (AI signal): npm `@emnapi/core` is 66.0% likely risky Notes: This module is a wasm/N-API compatibility runtime with significant dynamic execution capabilities. The most serious findings are direct use of eval() in napi_run_script and use of new Function(...) in its function-wrapper generator. If any attacker can influence the script string or the function/identifier metadata reaching these paths (e.g., via a malicious wasm module, tampered worker messages, or untrusted inputs), it can enable arbitrary JavaScript execution in the host. No explicit credential theft, network exfiltration, or reverse-shell behavior is evident in the provided fragment, so the risk is primarily code-execution-driven rather than classic malware I/O. Confidence: 0.66 Severity: 0.70 From: package.json → `npm/knip@6.34.0` → `npm/@emnapi/core@1.11.2` ℹ Read more on: This package \| This alert \| What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.11.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm `@oxc-resolver/binding-wasm32-wasi` is 75.0% likely risky Notes: The JavaScript loader is a legitimate-looking WASI/N-API binding that synchronously instantiates and runs an opaque wasm binary. The immediate concerns are the privileges granted to the wasm: the loader passes the entire process.env to WASI and preopens the host filesystem root, giving the wasm potential access to environment secrets and the filesystem. Worker creation also forwards env and routes worker messages into wasm-controlled filesystem proxy functions. The JS code itself does not contain clear malware patterns, but because it executes an external wasm binary with broad privileges, this package carries a significant supply-chain risk if the wasm is malicious or tampered with. Recommend auditing the wasm binary (resolver.wasm32-wasi.wasm), removing or narrowing preopens, and avoiding passing full process.env to WASI/workers unless necessary. Confidence: 0.75 Severity: 0.70 From: package.json → `npm/knip@6.34.0` → `npm/@oxc-resolver/binding-wasm32-wasi@11.24.2` ℹ Read more on: This package \| This alert \| What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `formatly` in module child_process Module: child_process Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/formatly@0.7.0` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/formatly@0.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `oxc-parser` in module child_process Module: child_process Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-parser@0.147.0` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-parser@0.147.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `oxc-parser` in module node:child_process Module: node:child_process Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-parser@0.147.0` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-parser@0.147.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `oxc-resolver` in module child_process Module: child_process Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-resolver@11.24.2` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-resolver@11.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `oxc-resolver` in module node:child_process Module: node:child_process Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-resolver@11.24.2` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-resolver@11.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `@emnapi/core` is 60.0% likely to have a medium risk anomaly Notes: The file package/dist/emnapi-core.min.js contains a wasm/N-API interop runtime that enables arbitrary JavaScript execution through eval in napi_run_script and dynamic function generation via new Function during wrapper creation. If attacker-controlled input reaches these dynamic paths (via unsafe wrapper code or a malicious WASM module), it can lead to remote code execution in the Node process and potentially in spawned workers. Confidence: 0.60 Severity: 0.70 From: package.json → `npm/knip@6.34.0` → `npm/@emnapi/core@1.11.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.11.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `@emnapi/core` is 62.0% likely to have a medium risk anomaly Notes: Overall, this looks like a runtime/interop layer rather than overt malware. The key risk is that the module provides host-side dynamic code execution via napi_run_script (uses g.eval on a wasm-provided script string) and via emnapiCreateFunction (uses new Function). These are high-impact sinks if attacker-controlled data reaches them (e.g., untrusted wasm module or untrusted script/function name inputs). Without evidence of network/filesystem/credential theft in the shown code, malware likelihood is moderate, but security risk is elevated due to eval-like behavior. Confidence: 0.62 Severity: 0.58 From: package.json → `npm/knip@6.34.0` → `npm/@emnapi/core@1.11.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.11.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `@emnapi/core` is 62.0% likely to have a medium risk anomaly Notes: No clear evidence of overt supply-chain malware (e.g., network exfiltration, filesystem/OS command execution, or credential theft) is present in the reviewed fragment. However, the module includes high-impact dynamic execution capabilities: an explicit eval-like API (napi_run_script uses g.eval) and dynamic function construction (new Function in emnapiCreateFunction). Combined with indirect wasm table calls and highly extensible import overrides, this creates a potentially serious security risk if any attacker can influence the script/function inputs or the import object/worker initialization payloads. Confidence: 0.62 Severity: 0.68 From: package.json → `npm/knip@6.34.0` → `npm/@emnapi/core@1.11.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.11.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `@emnapi/core` is 66.0% likely to have a medium risk anomaly Notes: This code fragment implements a WASM↔JS runtime bridge with async worker support and heavy marshalling. The dominant security concern is its high-impact dynamic execution capabilities: it directly calls eval() on a string obtained from WASM/handle storage (napi_run_script) and uses new Function(...) to construct wrappers from runtime-provided identifiers (re()). Additionally, it dynamically dispatches JS callbacks based on WASM-derived work/queue state. No explicit network exfiltration or credential theft is evident in the excerpt, but if a malicious/compromised WASM module can influence the evaluated strings or selected callbacks, the module can enable arbitrary code execution in the embedding environment. Require strong trust controls on the WASM artifact and constrain any path that can feed untrusted strings/identifiers into these sinks. Confidence: 0.66 Severity: 0.66 From: package.json → `npm/knip@6.34.0` → `npm/@emnapi/core@1.11.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.11.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `@oxc-resolver/binding-wasm32-wasi` is 90.0% likely to have a medium risk anomaly Notes: This loader establishes a Node.js WASI/worker environment that: 1) passes the entire host process.env into the WASI instance (exposing all environment variables, including secrets, to loaded modules); 2) preopens the filesystem root (granting broad file read/write access under the host’s root directory); and 3) implements importScripts via synchronous fs.readFileSync + eval (allowing any local JS file to be executed in the loader context). If an untrusted or compromised WASM module or script is provided, it can read sensitive environment variables, access or modify arbitrary files, and execute arbitrary JavaScript—posing a moderate security risk. Recommended mitigations: restrict WASI preopens to a minimal directory, limit or sanitize environment variables passed into WASI, and replace or sandbox the eval-based importScripts mechanism. Confidence: 0.90 Severity: 0.60 From: package.json → `npm/knip@6.34.0` → `npm/@oxc-resolver/binding-wasm32-wasi@11.24.2` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@oxc-resolver/binding-wasm32-wasi` Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/@oxc-resolver/binding-wasm32-wasi@11.24.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@oxc-resolver/binding-wasm32-wasi` Env Vars: NAPI_RS_ASYNC_WORK_POOL_SIZE Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/@oxc-resolver/binding-wasm32-wasi@11.24.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@oxc-resolver/binding-wasm32-wasi` reads UV_THREADPOOL_SIZE Env Vars: UV_THREADPOOL_SIZE Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/@oxc-resolver/binding-wasm32-wasi@11.24.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@oxc-resolver/binding-wasm32-wasi@11.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `jiti` is 68.0% likely to have a medium risk anomaly Notes: The fragment implements a sophisticated on-the-fly loader using JITI for transpilation and execution, with careful handling of JSON interop based on nearby package.json type. There is no explicit malicious behavior identified (no external network activity, no hardcoded secrets). However, the dynamic code execution path introduced by _wrapSource and the synthetic module environment represents a potential risk vector if untrusted inputs are loaded, or if jiti/mjs execution context could be manipulated. This warrants strict review of the loader environment, the version and security of JITI, and checks on the sources being loaded to mitigate potential code execution or supply chain concerns. Confidence: 0.68 Severity: 0.60 From: package.json → `npm/eslint@9.39.5` → `npm/knip@6.34.0` → `npm/jiti@2.7.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jiti@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `jiti` Location: Package overview From: package.json → `npm/eslint@9.39.5` → `npm/knip@6.34.0` → `npm/jiti@2.7.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jiti@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `jiti` reads TMPDIR Env Vars: TMPDIR Location: Package overview From: package.json → `npm/eslint@9.39.5` → `npm/knip@6.34.0` → `npm/jiti@2.7.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jiti@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `jiti` reads JITI_RESPECT_TMPDIR_ENV Env Vars: JITI_RESPECT_TMPDIR_ENV Location: Package overview From: package.json → `npm/eslint@9.39.5` → `npm/knip@6.34.0` → `npm/jiti@2.7.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jiti@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm `oxc-parser` is 80.0% likely to have a medium risk anomaly Notes: The module installs a binding package at runtime via pnpm into a predictable location and requires it during module load, performing network installation without integrity checks. This creates a supply-chain and remote-code-execution risk if an attacker can tamper with the registry, the package, or the installation path. Mitigations include removing runtime installs from require-time, preinstalling bindings during CI/install, validating integrity, and avoiding writable temporary directories or ensuring atomic installations. Confidence: 0.80 Severity: 0.70 From: package.json → `npm/knip@6.34.0` → `npm/oxc-parser@0.147.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-parser@0.147.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `oxc-parser` reads NAPI_RS_NATIVE_LIBRARY_PATH Env Vars: NAPI_RS_NATIVE_LIBRARY_PATH Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-parser@0.147.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-parser@0.147.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `oxc-parser` Env Vars: NAPI_RS_ENFORCE_VERSION_CHECK Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-parser@0.147.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-parser@0.147.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `oxc-parser` reads NAPI_RS_WASI_FLAVOR Env Vars: NAPI_RS_WASI_FLAVOR Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-parser@0.147.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-parser@0.147.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `oxc-parser` reads NAPI_RS_FORCE_WASI Env Vars: NAPI_RS_FORCE_WASI Location: Package overview From: package.json → `npm/knip@6.34.0` → `npm/oxc-parser@0.147.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/oxc-parser@0.147.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 10 more rows in the dashboard

View full report

The merge-base changed after approval.

Core dropped depcheck for knip, so match it. depcheck ^1.4.7 removed, along with .depcheckrc.json knip ^6.23.0 added, with knip.config.mts Scripts follow core's shape: lint:dependencies bakes in `yarn dedupe --check` and a separate lint:dependencies:fix runs the writing form, rather than passing --check through from `lint`. The config is nine lines rather than core's 292, because that file is almost entirely per workspace tuning for a monorepo and this is a single package. Only the two lavamoat packages need ignoring: both are wired in through the Yarn plugin and the lavamoat.allowScripts field rather than imported, so knip cannot see the usage. Switching also turned up dead weight that depcheck had been hiding. Its ignore list included ts-node, which nothing references: it is not a peer of ts-jest, appears nowhere outside its own package.json entry, and core does not carry it. Removed rather than re-ignored. knip requires Node ^20.19.0 || >=22.12.0. Only the Lint job runs it, and that job is pinned to 22.x, so this is safe ahead of the Node floor bump.

cryptodev-2s added this pull request to stack #331 September 9, 2026 11:47

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from c6ce5d5 to 8e8ab88 Compare September 9, 2026 16:09

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from 8e8ab88 to 0fa1ca9 Compare September 9, 2026 16:10

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from 0fa1ca9 to e6b288c Compare September 9, 2026 16:32

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from e6b288c to 483699b Compare September 9, 2026 18:31

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from 483699b to 9409f44 Compare September 9, 2026 18:47

Mrtenz previously approved these changes Sep 10, 2026

View reviewed changes

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from 9409f44 to c5dcd6a Compare September 10, 2026 10:15

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from c5dcd6a to 17da708 Compare September 10, 2026 10:28

cryptodev-2s removed this pull request from stack #331 September 10, 2026 10:40

cryptodev-2s force-pushed the migrate/swap-depcheck-for-knip branch from 17da708 to 9cecd71 Compare September 10, 2026 10:41

cryptodev-2s added this pull request to stack #335 September 10, 2026 10:41

cryptodev-2s requested a review from Mrtenz September 10, 2026 10:46

Mrtenz approved these changes Sep 10, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

chore: replace depcheck with knip - #330

chore: replace depcheck with knip#330
cryptodev-2s wants to merge 1 commit into
migrate/pr2h-fix-tsdfrom
migrate/swap-depcheck-for-knip

cryptodev-2s commented Sep 9, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

cryptodev-2s commented Sep 9, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Config is nine lines, not core's 292

It found dead weight depcheck was hiding

Node requirement

Uh oh!

socket-security Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cryptodev-2s commented Sep 9, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Sep 9, 2026 •

edited

Loading

socket-security Bot commented Sep 9, 2026 •

edited

Loading