What to do when you receive an alert

Developers sometimes ask "What do I do when I receive a Socket alert on added or updated dependencies?". Like all good questions, the first part of the answer tends to be "It depends!".

Remove a package entirely

If you happen to install a dependency that Socket reports as Known Malware or a Protestware/Troll Package, you should immediately remove it and pick a different dependency.

For larger malware campaigns, the Socket blog usually has a detailed write-up, typically including indicators of compromise (IOCs) you can use to determine whether and how you were affected.

Take a closer look

On the other hand, if you add or update a package that introduces an Install Script or Native Code you should take a quick moment to audit the source code of the package to make sure it's not doing anything malicious.

If Socket detects a Potential Typo Squat, you should ensure you actually installed the correct package before dismissing the alert. If you're not sure what to do, you can always ask us, or someone on your security team, for help.

Disable the offending package behavior

Finally, if you add or update a package which collects Telemetry, then you can follow the instructions in the pull request alert to disable the offending package behavior, i.e. stop the collection of telemetry, in your app.

Ignore an alert

If you review an alert and accept the risk, you can ignore it from the Socket dashboard by changing its alert action. See Alert actions and triage.

Repository contributors can also ignore an alert from the pull request with a bot command. See Ignoring pull request alerts.