March 24, 2025 at 1:41:43 PM UTC

	Since	posts	replies	likes	reposts and quotes	views
Bluesky	May 2023	1,039	8,236	23,127	2,380
Mastodon	Nov 2022	2,399	29,156	55,396	16,820
GitHub	Jul 2010	179	5,777 3,520	33,866	3,317
npm	Jul 2014	139	1,546			75,991,720
YouTube	Dec 2015	30		1,203		32,713
Letterboxd	Mar 2026	55
Blog	Nov 2025	20
Hacker News	Jan 2011	59	575	802
All	Jul 2010	4,807	37,967	114,394	22,517	76,024,433

Why does socket.dev report that the latest version of next.js has a malware dependency? https://socket.dev/npm/package/next/alerts/15.2.3?tab=dependencies

“Malicious code in gen-mapping (npm) Any computer that has this package installed or running should be considered fully compromised.”

Update: looks like this is a pretty big flaw in the vulnerability scanner — not in next (check the replies for more info)

Screenshot of socket.dev report has the following alert: Known malware: This package is malware. We have asked the package registry to remove it. Found 1 instance in 1 package

19 replies

chris b 💖 3 min later

@zachleat auth0 just sent me a CVE about their NextJS because we use their nextjs-auth0 package 😬 https://sec.okta.com/articles/nextjs-CVE-202529927/
1. Zach Leatherman 8 min later
  
  @chrisw_b ah, yeah — I saw some discussion about that! That’s why I went to socket to look at the reports, but this seems unrelated?
  1. chris b 💖 11 min later
    
    @zachleat oh yeah, you're right! sorry I didn't actually finish reading everything first- looks like it's just a mistake though; someone squatting a non-scoped version of the same package: https://github.com/jridgewell/gen-mapping/issues/12
    1. Zach Leatherman 13 min later
      
      @chrisw_b whoa, this is a *wild* mistake by the socket team then? They’re reporting every single version of this package as malware
      1. chris b 💖 17 min later
        
        @zachleat yeah I'm guessing they use this tool, and I'm baffled that this would go unaddressed so long? https://github.com/anchore/grype/issues/1701
        name squatting has been an issue with npm forever, telling scoped packages and non scoped apart feels essential?
        
        Zach Leatherman 19 min later
        
        @chrisw_b WOW.
Matt Wilcox 7 min later

@zachleat https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
EDIT: Oh shit no, that's a different major issue. Yikes.
Tim Severien 17 min later

@zachleat Diving into it now. It seems that socket.dev sources its info from osv.dev, which claims the package has embedded malicious code. Not sure where that is coming from.
- https://test.osv.dev/vulnerability/MAL-2022-3326
- https://cwe.mitre.org/data/definitions/506.html
1. Zach Leatherman 18 min later
  
  @timsev someone linked me to https://github.com/jridgewell/gen-mapping/issues/12 which seems to suggest a `gen-mapping` report from 2022 is being misattributed to this namespaced package
  1. Tim Severien 27 min later
    
    @zachleat Ah, that could explain things!
westbrook 20 min later

@zachleat Why _didn't_ the do it for the last version? 😉
Now, that is the questions...
1. Zach Leatherman 26 min later
  
  @westbrook 😅
Zach Leatherman 32 min later

Update: thanks to @chrisw_b for hunting this down: looks like a huge flaw in the vulnerability scanner being used by these tools (it ignores namespaces on package names!)
More info:
https://github.com/jridgewell/gen-mapping/issues/12
https://github.com/anchore/grype/issues/1701
1. Zach Leatherman 42 min later
  1. Zach Leatherman 2 hr later
    
    it’s hard not to be jaded when facial recognition is being used in criminal investigations while our industry is having trouble accurately testing whether two strings are equal
  2. Doug Parker 🕸️ 17 hr later
    
    @zachleat
    ACTUALLY `name` was deprecated after two versions and now links to `@name/name` which contains the same code.
    They're completely different.
    1. Zach Leatherman 23 hr later
      
      @develwithoutacause @name oh no.
2. Zach Leatherman 4 hr later
  
  The @SocketSecurity folks have quickly fixed this one:
  https://bsky.app/profile/socket.dev/post/3ll5dewnrx22b
3. Zach Leatherman May 13, 2025
  
  Another update: the socket.dev folks fixed this on their end almost immediately but this has now also been fixed upstream in `grype` too: https://github.com/anchore/grype/issues/1701
  @chrisw_b