Confidence: 0.90

Location: Package overview

From: ? → npm/react-native@0.85.0 → npm/@react-native/debugger-frontend@0.85.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Confidence: 0.90

Location: Package overview

From: ? → npm/react-native@0.85.0 → npm/@react-native/debugger-frontend@0.85.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: No direct signs of classic malware (exfiltration, persistence, crypto-mining, hidden payloads) are present in this snippet. However, the middleware exposes a powerful local side effect—invoking @react-native-community/cli-tools’ launchEditor—with file path and line number taken directly from unauthenticated, unvalidated HTTP POST input. This is a significant security risk and should be protected with authentication/authorization and strict input validation/allowlisting (and ideally constrained to safe file/path contexts).

Confidence: 0.66

Severity: 0.78

From: ? → npm/@react-native-community/cli@20.1.0 → npm/@react-native-community/cli-server-api@20.1.0

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native-community/cli-server-api@20.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: No overt stealthy malware behavior is present in this snippet, but the module implements a high-impact remote code execution mechanism: it executes JavaScript strings delivered via WebSocket updates using eval/globalEvalWithSourceUrl, without any message authentication/integrity checks in this file. If the HMR server or connection can be tampered with, this becomes a straightforward RCE vector; otherwise, risk is primarily tied to deployment/trust configuration rather than hidden malicious logic.

Confidence: 0.70

Severity: 0.74

From: ? → npm/@react-native/metro-config@0.85.0 → npm/react-native@0.85.0 → npm/metro-runtime@0.84.4

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/metro-runtime@0.84.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: This module performs runtime JavaScript execution by evaluating a provided code string (body) via eval() or a sourceURL-attributed evaluator. Because the snippet shows no validation/integrity checks for body, any attacker influence over body (or over the URL/content feeding it) would enable arbitrary code execution, which is a serious supply-chain/runtime injection risk. No direct malicious exfiltration/persistence behavior is visible in the provided fragment, so malware is not confirmed, but the security risk from the eval-based design is high.

Confidence: 0.66

Severity: 0.78

From: package.json → npm/react-native@0.85.0

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native@0.85.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: The code fragment appears to be a standard Markdown parser/renderer with extension support (similar to Marked). There is no evidence of malware, data exfiltration, or external communications within the fragment itself. The principal security concern is safe handling of generated HTML: ensure the consuming application sanitizes or escapes content appropriately or uses a renderer that enforces safe output. Monitor any extensions for unsafe renderers/tokenizers that could bypass sanitization or introduce insecure output paths.

Confidence: 0.77

Severity: 0.60

From: ? → npm/react-native@0.85.0 → npm/@react-native/debugger-frontend@0.85.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.85.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: This module is an interception/monitoring utility that monkey-patches native WebSocket networking methods and forwards connection/message/error/close data to consumer-provided callbacks. It does not directly exfiltrate data or execute suspicious behaviors within this fragment, but it creates a high-sensitivity capability (WebSocket payload visibility) that could be abused for privacy-invasive surveillance if the callback registration and interception enabling are reachable by malicious or untrusted code. Review who can call enableInterception() and set*Callback(), and ensure callbacks do not forward captured traffic to untrusted destinations.

Confidence: 0.62

Severity: 0.55

From: package.json → npm/react-native@0.85.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/react-native@0.85.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.