# Dual-use disclosure

Packages: socket, @socketsecurity/cli, @socketsecurity/cli-with-sentry
Content policy class: dual-use (https://docs.npmjs.com/policies/dual-use)

All three packages are built from one source tree
(https://github.com/SocketDev/socket-cli, branch v1.x). "socket" is the
primary package. "@socketsecurity/cli" is the same tool published under its
older name. "@socketsecurity/cli-with-sentry" is the same tool with the
Sentry error-reporting library added.

## What the packages do that can look like malware

The packages install command-line executables: socket, socket-npm,
socket-npx, socket-pnpm, and socket-yarn. The two variant packages ship the
same commands and add variant-named aliases of them. These commands wrap
the npm, npx, pnpm, and yarn package managers: when a user runs an install
through them, the tool reads the dependency tree first, sends package names
and versions to the socket.dev security API for analysis, and can warn
about or refuse to continue an install when a dependency looks risky. The
tool can also read project files such as manifests, lockfiles, and package
contents to build a security scan, and it uploads those scan inputs to
socket.dev when the user requests a scan. Wrapping package managers,
stopping installs, reading project files, and uploading scan data are
behaviors that automated malware scanning can mistake for malicious
software.

## What the packages send over the network

The tool talks to the socket.dev API to run the security analysis the user
asked for. It sends what that analysis needs: package names and versions,
dependency manifests and lockfiles, and the scan files the user chose to
upload. The user's API token is sent to authenticate those requests. In
addition, the @socketsecurity/cli-with-sentry variant bundles the
@sentry/node library and reports errors and crashes to Sentry so the
maintainers can debug failures. The other two packages do not include
Sentry.

## Intended legitimate use

The packages exist for defensive supply-chain security: developers and CI
systems use them to find known-malicious, hijacked, typosquatted, or
policy-violating dependencies before those dependencies run. The tool runs
only when a user or a CI job invokes it. Its source code is public at
https://github.com/SocketDev/socket-cli and issues are tracked there.
