Walletconnect v2

[nicolasbrugneaux]

[Closes #341)

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated
react-celo	✅ Ready (Inspect)	Visit Preview	💬 Add your feedback	Feb 17, 2023 at 5:22PM (UTC)

[socket-security]

Socket Security Pull Request Report

Dependency issues detected: If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package	Script field	Source
nx@15.2.3 (upgraded)	postinstall	package.json via lerna@5.6.2

😵‍💫 Bin script confusion

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack

Consider removing one of the conflicting packages. Packages should only export bin scripts with their name

Package	Bin script	Source
@zkochan/js-yaml@0.0.6 (added)	js-yaml	package.json via lerna@5.6.2
js-yaml@3.14.1 (added)	js-yaml	package.json via jest@28.1.3, lerna@5.6.2, ts-jest@28.0.8
js-yaml@4.1.0 (added)	js-yaml	package.json via @typescript-eslint/eslint-plugin@5.45.0, @typescript-eslint/parser@5.45.0, @walletconnect/auth-client@2.0.2, @walletconnect/types@2.3.2, eslint@8.28.0, eslint-config-prettier@8.5.0, eslint-plugin-import@2.26.0, eslint-plugin-prettier@4.2.1, eslint-plugin-react@7.31.11, eslint-plugin-react-hooks@4.6.0, eslint-plugin-simple-import-sort@7.0.0, eslint-plugin-unused-imports@2.0.0, lerna@5.6.2, packages/example/package.json via @walletconnect/types@2.3.2, packages/walletconnect/package.json via @walletconnect/auth-client@2.0.2, @walletconnect/sign-client@2.4.4, @walletconnect/types@2.4.4, @walletconnect/utils@2.4.4

Pull request report summary

Issue	Status
Install scripts	⚠️ 1 issue
Native code	✅ 0 issues
Bin script confusion	⚠️ 3 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2

• @SocketSecurity ignore nx@15.2.3
• @SocketSecurity ignore @zkochan/js-yaml@0.0.6
• @SocketSecurity ignore js-yaml@3.14.1
• @SocketSecurity ignore js-yaml@4.1.0

Powered by socket.dev