# Dual-use disclosure

Package: socket

Content policy class: dual-use (https://docs.npmjs.com/policies/dual-use)

## What the tool does that can look like malware

This package builds the Socket CLI, a security research tool. It ships the

socket, socket-npm, socket-npx, socket-pnpm, and socket-yarn executables.

The package-manager commands wrap npm, pnpm, and yarn: when a user runs

an install through them, the tool reads the dependency tree first, sends

package names and versions to the socket.dev security API for analysis, and

can warn about or refuse to continue an install when a dependency looks

risky. The tool can also read project files such as manifests, lockfiles,

and package contents to build a security scan, and it uploads those scan

inputs to socket.dev when the user requests a scan. Wrapping package

managers, stopping installs, reading project files, and uploading scan data

are behaviors that automated malware scanning can mistake for malicious

software.

## What the tool sends over the network

The tool talks to the socket.dev API to run the security analysis the user

asked for. It sends what that analysis needs: package names and versions,

dependency manifests and lockfiles, and the scan files the user chose to

upload. The user's API token is sent to authenticate those requests.

## Intended legitimate use

The tool exists for defensive supply-chain security: developers and CI

systems use it to find known-malicious, hijacked, typosquatted, or

policy-violating dependencies before those dependencies run. The tool runs

only when a user or a CI job invokes it. Its source code is public at

https://github.com/SocketDev/socket-cli and issues are tracked there.