[wachunei]

Details

Adds two iOS functions so an app can show a card's verification state and finish activation without sending the user to Wallet:

• listAppleWalletPasses() returns every Secure Element pass on the iPhone and on a paired Apple Watch, with activationState (requireActivation, pending, active, and the other CardStatus values) and isRemote.
• activateAppleWalletPass({ passTypeIdentifier, serialNumber, activationData, isRemote }) activates a pass that is waiting for activation. isRemote selects the Watch pass when the same card is on both devices.

Ported from ShpetimA/react-native-wallet (d122f802, ca6c4044), adapted to current main: the old architecture reads struct fields with the existing per-parameter #ifdef, and Android gets no-op stubs so the shared TurboModule spec still builds.

getCardStatusBySuffix and getCardStatusByIdentifier are unchanged and still report only the iPhone pass.

Related Issues

Expensify#84
Expensify#45

Manual Tests

• On an iPhone with a card in Wallet, call listAppleWalletPasses() and confirm the pass is returned with isRemote: false and an activationState.
• Pair an Apple Watch that has the same card (or only the Watch has it). Confirm a second entry with isRemote: true, and that a Watch-only card is no longer reported as not found.
• For a pass in requireActivation, call activateAppleWalletPass with issuer activation data and the matching isRemote flag. Confirm it resolves true and a following list shows active.
• Confirm activateAppleWalletPass rejects when activation data is not base64, the pass is missing, or the pass is not eligible.
• Confirm both functions are safe to import on Android: listing resolves [], and activation throws.

Linked PRs

Expensify#91 also edits the TurboModule spec, the README function table, and WalletManager.swift / RNWallet.mm. Whichever lands second will need a small rebase. This PR does not depend on Expensify#91.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​concurrent-ruby@​1.3.3 ⏵ 1.3.8		+18
	gem/​logger@​1.7.0
	gem/​benchmark@​0.5.0

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Priority	Alert  (click "▶" to expand/collapse)	Action
	System shell access: gem benchmark Location: Package overview From: apps/basic-example/Gemfile.lock → gem/benchmark@0.5.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/benchmark@0.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Potential security risk (AI signal): npm metro-runtime is 76.0% likely risky Notes: This module is an HMR client that intentionally performs runtime JavaScript injection by executing server-supplied module code via eval/globalEvalWithSourceUrl. In the absence of integrity/authentication/origin checks in this module, it can act as a remote code execution channel if an attacker can control or spoof the WebSocket endpoint or messages. No additional malicious behaviors (exfiltration/credential theft/system modification) are evident in this fragment beyond the eval-based injection pipeline. Confidence: 0.76 Severity: 0.82 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/@react-native/metro-config@0.81.0 → npm/react-native@0.81.0 → npm/react-native@0.81.4 → npm/expo-module-scripts@5.0.8 → npm/metro-runtime@0.83.8 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/metro-runtime@0.83.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Publisher changed: npm accepts is now published by wesleytodd instead of dougwilson New Author: wesleytodd Previous Author: dougwilson From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/@react-native/metro-config@0.81.0 → npm/react-native@0.81.0 → npm/react-native@0.81.4 → npm/expo-module-scripts@5.0.8 → npm/accepts@2.0.0 ℹ Read more on: This package | This alert | What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/accepts@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Network access: npm @tootallnate/quickjs-emscripten in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → npm/release-it@15.11.0 → npm/@tootallnate/quickjs-emscripten@0.23.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tootallnate/quickjs-emscripten@0.23.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm js-yaml is 65.0% likely to have a medium risk anomaly Notes: The script functions as a straightforward JSON↔YAML translator CLI with standard error handling. The primary security concern is the use of yaml.loadAll without a safeLoad alternative, which could enable YAML deserialization risks if inputs contain crafted tags. To improve security, switch to a safe loader (e.g., yaml.safeLoadAll or equivalent) or ensure the library is configured to restrict risky constructors. Overall, no malware indicators were observed; the risk is confined to YAML deserialization semantics. Confidence: 0.65 Severity: 0.60 From: apps/expo-example/package-lock.json → npm/babel-jest@29.7.0 → npm/jest@29.7.0 → npm/react-native@0.81.4 → npm/eslint-config-expensify@2.0.24 → npm/expo-module-scripts@5.0.8 → npm/js-yaml@3.15.2 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@3.15.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm metro-file-map is 65.0% likely to have a medium risk anomaly Notes: No direct malicious payload is evident in this snippet (no network/command execution/obvious backdoor behavior). The primary security risk is architectural: unvalidated dynamic require(modulePath) executes attacker-influenced plugin code, and plugins receive a lazy getContent() capability that reads fs.readFileSync(filePath), enabling unauthorized file access and potential data leakage depending on caller trust boundaries and plugin trustworthiness. Treat this module as high-risk if any of setup/plugins or processFile inputs can be influenced by an attacker. Confidence: 0.65 Severity: 0.63 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/@react-native/metro-config@0.81.0 → npm/react-native@0.81.0 → npm/react-native@0.81.4 → npm/expo-module-scripts@5.0.8 → npm/metro-file-map@0.83.8 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/metro-file-map@0.83.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm metro-file-map is 62.0% likely to have a medium risk anomaly Notes: This module is not overtly malware-like in the snippet (no network/process spawning or explicit credential theft), but it is a high-privilege orchestrator. It dynamically loads plugin code via require(modulePath) and performs unvalidated synchronous filesystem reads via fs.readFileSync(filePath). Because it also passes a getContent() helper to plugins, it effectively enables arbitrary filesystem read capability and arbitrary code execution if attacker-controlled inputs can reach plugins’ configuration or data.filePath. Confidence: 0.62 Severity: 0.64 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/@react-native/metro-config@0.81.0 → npm/react-native@0.81.0 → npm/react-native@0.81.4 → npm/expo-module-scripts@5.0.8 → npm/metro-file-map@0.83.8 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/metro-file-map@0.83.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm metro-transform-worker is 68.0% likely to have a medium risk anomaly Notes: The module is a thin wrapper around dynamic require(). The dominant risk is that minifierPath is caller-controlled and used directly in require(minifierPath) without validation, which can enable arbitrary module loading/code execution if minifierPath is not strictly controlled upstream. Additionally, error messages expose minifierPath and underlying loader errors, creating potential information disclosure to logs/callers. No explicit malicious payload behavior or obfuscation is evident in this fragment. Confidence: 0.68 Severity: 0.62 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/@react-native/metro-config@0.81.0 → npm/react-native@0.81.0 → npm/react-native@0.81.4 → npm/expo-module-scripts@5.0.8 → npm/metro-transform-worker@0.83.8 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/metro-transform-worker@0.83.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm metro-transform-worker is 60.0% likely to have a medium risk anomaly Notes: The fragment is not overtly malicious and contains no explicit exfiltration or payload behavior. However, it introduces a security-sensitive primitive: a dynamic require(minifierPath) that can enable unintended/arbitrary module loading if minifierPath is influenced by an attacker or misconfigured. The thrown error also risks leaking the attempted specifier and underlying resolution details. Overall risk depends primarily on how strictly minifierPath is controlled by the calling code. Confidence: 0.60 Severity: 0.50 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/@react-native/metro-config@0.81.0 → npm/react-native@0.81.0 → npm/react-native@0.81.4 → npm/expo-module-scripts@5.0.8 → npm/metro-transform-worker@0.83.8 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/metro-transform-worker@0.83.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm metro is 70.0% likely to have a medium risk anomaly Notes: No direct evidence of malware or stealth behavior is present in this wrapper code (no network access, credential theft, or obvious payload execution). However, it creates meaningful security exposure by (1) synchronously reading arbitrary paths derived from filename/projectRoot without visible sandboxing and (2) dynamically requiring a transformer module based on transformerConfig.transformerPath and then executing it with the input data and configuration. If transformerPath or filename/projectRoot can be influenced by an attacker, the risk shifts from “tooling” to potentially arbitrary code execution and/or information disclosure within the worker/build pipeline. Confidence: 0.70 Severity: 0.50 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/@react-native/metro-config@0.81.0 → npm/react-native@0.81.0 → npm/react-native@0.81.4 → npm/expo-module-scripts@5.0.8 → npm/metro@0.83.8 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/metro@0.83.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm tar is 66.0% likely to have a medium risk anomaly Notes: This module acts as a standard tar extraction wrapper using synchronous and asynchronous code paths. There is no evident malicious activity within this fragment. Security risk hinges on the behavior of the Unpack/UnpackSync implementation and how tar entries are written to disk (e.g., path traversal). No hardcoded secrets or network calls are present here. Recommend ensuring tar extraction handles path traversal and destination path sanitization in Unpack, and consider validating opt.file presence and type before streaming. Confidence: 0.66 Severity: 0.56 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/expo-module-scripts@5.0.8 → npm/tar@7.5.22 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tar@7.5.22. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm undici is 75.0% likely to have a medium risk anomaly Notes: The analyzed code appears to implement a standard in-memory cache batch operation flow (put/delete) with careful handling of response bodies by buffering and storing bytes for caching. No signs of malware, data exfiltration, backdoors, or obfuscated behavior were found. The primary security considerations relate to memory usage from buffering potentially large response bodies and ensuring robust validation within batch operations to prevent cache state corruption. Overall risk is moderate, driven by in-memory data handling rather than external communication. Confidence: 0.75 Severity: 0.60 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/expo-module-scripts@5.0.8 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm undici is 68.0% likely to have a medium risk anomaly Notes: The analyzed code implements a conventional HTTP/WebSocket-like upgrade handler with proper input validation, abort signal integration, and asynchronous callback management. It does not exhibit malicious activity such as data exfiltration or backdoors. The deliberate onHeaders error path is consistent with protocol expectations to reject non-upgrade responses. Overall security risk remains low to moderate, contingent on integration context, but no indicators of malware or obfuscation are detected in this fragment. Confidence: 0.68 Severity: 0.50 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/expo-module-scripts@5.0.8 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm undici is 65.0% likely to have a medium risk anomaly Notes: The code is a focused error-handling helper for HTTP responses that safely parses small payloads to include in an error object. It includes protective measures (chunk limits, controlled parsing, microtask-based callbacks) but uses unusual, brittle content-type checks and suppresses stack traces for debugging concealment. There is no evidence of malicious activity, data exfiltration, or backdoors within this fragment. The main risk is potential silent data loss if payloads exceed the chunk limit or mismatched content-type handling leads to missing payloads, but this is a functional trade-off rather than malicious. Suggested improvements include robust content-type parsing, clearer error signaling when payload is truncated, and optional logging to aid debugging without exposing stack traces in production. Confidence: 0.65 Severity: 0.58 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/expo-module-scripts@5.0.8 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm undici is 77.0% likely to have a medium risk anomaly Notes: The script performs an in-place, lossy re-encoding of a local file from UTF-8 to Latin-1 and rewrites it without backups or validation. This is unsafe due to potential data loss and code corruption, and could be exploited to tamper with source files in a supply chain. It does not exhibit active malware behavior, but its destructive nature warrants removal or strict safeguards (backups, explicit intent, error handling). Confidence: 0.77 Severity: 0.65 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/expo-module-scripts@5.0.8 → npm/undici@6.29.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.29.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm ws is 75.0% likely to have a medium risk anomaly Notes: The code implements a standard EventTarget-like mixin for wrapping event listeners and dispatching events to user callbacks. There are no suspicious patterns such as dynamic code execution, hardcoded secrets, or network activity. The risk is contingent on what the consumer does inside their handlers; the snippet itself does not introduce malware or data leakage mechanisms beyond normal event dispatch. Overall security risk is low in isolation. Confidence: 0.75 Severity: 0.50 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/expo-module-scripts@5.0.8 → npm/ws@8.21.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ws@8.21.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm yaml is 68.0% likely to have a medium risk anomaly Notes: The code presents a standard, non-malicious NodeBase component used in YAML/JS conversion. The primary risk surface is the optional reviver and onAnchor callbacks provided by the user: if untrusted, these can execute arbitrary code or influence the transformed representation via applyReviver or the reviver itself. This is expected behavior for extensible YAML libraries; ensure callbacks come from trusted sources and sandbox or validate revivers where possible. Confidence: 0.68 Severity: 0.60 From: apps/expo-example/package-lock.json → npm/expo@54.0.33 → npm/react-native@0.81.4 → npm/yaml@2.9.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yaml@2.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): gem rexml is 65.0% likely to have a medium risk anomaly Notes: High risk due to dynamic evaluation of code constructed from path expressions. This introduces potential remote or local code execution if untrusted input can reach the predicate evaluation. The code is not obfuscated, but the eval usage constitutes a critical security flaw in the data flow from path input to execution. Recommend eliminating eval or sandboxing the predicate evaluation, and validating/sanitizing path expressions rigorously before any dynamic execution. The apparent truncation at the end (ends with 'en') suggests incomplete packaging, which could mask additional risks or render the library unusable. Use a safe, parser-based evaluation or a sandboxed evaluator to mitigate this supply-chain risk. Confidence: 0.65 Severity: 0.65 From: apps/basic-example/Gemfile.lock → gem/cocoapods@1.15.2 → gem/rexml@3.4.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/rexml@3.4.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential code anomaly (AI signal): npm @tootallnate/quickjs-emscripten is 62.0% likely to have a medium risk anomaly Notes: No concrete malicious payload indicators (no exfiltration, credential theft, network/system commands, or overt backdoor logic) are visible in this fragment. However, it implements a high-impact capability: arbitrary JavaScript evaluation via JS_Eval and ES module compilation from host-supplied module source through a host-callback loader. The primary supply-chain security concern is not hidden malware in this code, but the execution trust boundary: if upstream code or host callbacks can be influenced or tampered with, this module can become an arbitrary code execution/vector for malicious module injection. Treat Module['callbacks'] and the provenance/allowlisting of js_code and module_source as critical security controls. Confidence: 0.62 Severity: 0.64 From: package-lock.json → npm/release-it@15.11.0 → npm/@tootallnate/quickjs-emscripten@0.23.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tootallnate/quickjs-emscripten@0.23.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Environment variable access: npm @tootallnate/quickjs-emscripten reads QTS_DEBUG Env Vars: QTS_DEBUG Location: Package overview From: package-lock.json → npm/release-it@15.11.0 → npm/@tootallnate/quickjs-emscripten@0.23.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tootallnate/quickjs-emscripten@0.23.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
See 1 more row in the dashboard

View full report