What to do when you receive an alert

When a merge request introduces an alert, Socket's alerts comment lists it with its action, severity, details, and a link to the Socket report. What to do next depends on the alert.

Remove a package entirely

If Socket reports a dependency as Known Malware or a Protestware/Troll Package, remove it right away and pick a different dependency.

For larger malware campaigns, the Socket blog usually has a detailed write-up, with indicators of compromise (IOCs) to check whether and how you were affected.

Take a closer look

If you add or update a package that introduces an Install Script or Native Code, audit the package's source code to make sure it isn't doing anything malicious.

If Socket detects a Potential Typo Squat, confirm that you installed the package you meant to before you dismiss the alert. If you're not sure what to do, ask us or someone on your security team.

Disable the offending package behavior

If you add or update a package that collects Telemetry, follow the fix details in Socket's merge request comment to stop the collection of telemetry in your app.

Ignore an alert

If you review an alert and accept the risk, change its alert action or triage state in the Socket dashboard. See Alert actions and triage. The comment and the commit status update on the next push to the merge request.

Socket for GitLab doesn't act on comment replies, so a reply such as @SocketSecurity ignore has no effect. Triage the alert in the dashboard instead.