What to do when you receive an alert

When a pull request introduces an alert, Socket's comment on the pull request lists it under Review the following alerts detected in dependencies, with its action, severity, details, and a link to the Socket report. What to do next depends on the alert.

Remove a package entirely

If you install a dependency that Socket reports as Known Malware or a Protestware/Troll Package, remove it right away and pick a different dependency.

For larger malware campaigns, the Socket blog usually has a detailed write-up, typically including indicators of compromise (IOCs) you can use to determine whether and how you were affected.

Take a closer look

If you add or update a package that introduces an Install Script or Native Code, take a moment to audit the package's source code to make sure it isn't doing anything malicious.

If Socket detects a Potential Typo Squat, make sure you installed the package you meant to before you dismiss the alert. If you're not sure what to do, ask us or someone on your security team.

Disable the offending package behavior

If you add or update a package that collects Telemetry, follow the fix details in Socket's pull request comment to stop the collection of telemetry in your app.

Ignore an alert

If you review an alert and accept the risk, you can ignore it from the Socket dashboard by changing its alert action. See Alert actions and triage. Rerun the Socket check in Origin to update the pull request.