Skip to content

Add mobile examples#13764

Merged
dylanjeffers merged 3 commits intomainfrom
mobile-examples
Feb 25, 2026
Merged

Add mobile examples#13764
dylanjeffers merged 3 commits intomainfrom
mobile-examples

Conversation

@dylanjeffers
Copy link
Contributor

No description provided.

@changeset-bot
Copy link

changeset-bot bot commented Feb 25, 2026

⚠️ No Changeset found

Latest commit: 5bc34c7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security
Copy link

socket-security bot commented Feb 25, 2026

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Low
Potential code anomaly (AI signal): npm @babel/core is 100.0% likely to have a medium risk anomaly

Notes: The examined code is a standard, benign helper for constructing and wrapping configuration items from descriptors within Babel’s tooling. There is no evidence of data leakage, exfiltration, backdoors, or other malicious activity in this fragment. The combination of immutability, brand-based identity, and non-enumerable descriptor storage indicates a well-scoped internal utility rather than anything suspicious.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/@babel/core@7.29.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/core@7.29.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/helper-module-transforms is 100.0% likely to have a medium risk anomaly

Notes: The code is a legitimate, static-code transformation utility used in Babel to ensure proper behavior of ES module bindings after transforms. There is no evidence of malicious behavior, data leakage, or external communications within this fragment. It operates purely on AST-level transformations consistent with module import/export handling.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/@babel/core@7.29.0npm/babel-preset-expo@13.0.0npm/@babel/helper-module-transforms@7.28.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-module-transforms@7.28.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/helper-string-parser is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a standard, well-structured parsing utility for JavaScript string literals and escapes (consistent with Babel’s helper-string-parser). It includes thorough validation, proper Unicode handling, and defensive error reporting. There is no evidence of malicious behavior, data leakage, or network activity within this fragment. The security risk is low when used as part of a trusted toolchain; the code otherwise poses no evident supply-chain threat based on the provided snippet.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/@babel/core@7.29.0npm/babel-preset-expo@13.0.0npm/react-native@0.81.5npm/@babel/helper-string-parser@7.27.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helper-string-parser@7.27.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @babel/helpers is 100.0% likely to have a medium risk anomaly

Notes: The analyzed fragment is a conventional Babel/TypeScript-style decorators runtime (applyDecs) responsible for applying decorators to class members and managing metadata and initializers. There is no evidence of malware, backdoors, or external data leakage within this module. While complex, the code behaves as a metadata-driven decorator processor and should be considered low risk when used as intended. Downstream risks depend on the decorators provided by consumers, not this utility itself.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/@babel/core@7.29.0npm/@babel/helpers@7.28.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/helpers@7.28.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @expo/cli is 100.0% likely to have a medium risk anomaly

Notes: The module implements conventional authentication flows (password login and SSO) with session management and a small in-memory cache for the current user. There is no explicit malicious behavior identified. The primary security considerations include secure handling of session secrets in headers, sanitization of logs to avoid leaking sensitive data, and careful management of filesystem cleanup to ensure it cannot affect unintended files. While the overall approach is typical and reasonable, the in-memory currentUser caching and logout-side effects warrant review to avoid stale data, accidental exposure, or misconfiguration in the code signing directory cleanup.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/@expo/cli@54.0.23

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/cli@54.0.23. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @expo/cli is 100.0% likely to have a medium risk anomaly

Notes: The fragment implements a legitimate pattern for resolving and downloading repository templates from GitHub with careful extraction filtering to avoid pulling unnecessary files. There is no evidence of malicious behavior or backdoors within this code; it reads user-provided input, performs network requests to GitHub, and writes extracted content to a target directory. The risk is primarily supply-chain related (pulling and executing code from external repos) but expected for a template-installer tool and not due to embedded malware. Overall, low likelihood of hidden malware; moderate risk due to dependency on external repo contents and potential for malicious templates if misused by end-users or compromised repositories.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/@expo/cli@54.0.23

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo/cli@54.0.23. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @react-native/debugger-frontend is 100.0% likely to have a medium risk anomaly

Notes: The code fragment appears to be a standard Markdown parser/renderer with extension support (similar to Marked). There is no evidence of malware, data exfiltration, or external communications within the fragment itself. The principal security concern is safe handling of generated HTML: ensure the consuming application sanitizes or escapes content appropriately or uses a renderer that enforces safe output. Monitor any extensions for unsafe renderers/tokenizers that could bypass sanitization or introduce insecure output paths.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/react-native@0.81.5npm/@react-native/debugger-frontend@0.81.5

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.81.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm @ungap/structured-clone is 100.0% likely to have a medium risk anomaly

Notes: The code correctly reconstructs many built-in JS types and is functionally reasonable for trusted serialized inputs. However it performs dynamic constructor invocation using new envtype and env[name] for Error types without an allowlist or validation. If an attacker can control the serialized input, they can request instantiation of arbitrary global constructors (e.g., Function) or cause prototype pollution via crafted object keys, enabling code execution or other dangerous behavior. The module should only be used with trusted inputs or modified to restrict allowed constructor names and to guard against prototype pollution.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/@ungap/structured-clone@1.3.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ungap/structured-clone@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm any-promise is 100.0% likely to have a medium risk anomaly

Notes: The code implements a conventional, flexible Promise implementation loader for any-promise. It supports explicit, global, and auto-detected sources. The primary security concern is the possibility of loading untrusted code via dynamic require when an implementation is supplied or discovered through auto-detection. In trusted environments with strict dependency governance, this is acceptable but warrants input validation and potential pinning of the resolved module to mitigate supply-chain risks. Overall, the approach is standard for this type of loader with moderate supply-chain risk if inputs aren’t controlled.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/expo-linking@7.0.5npm/any-promise@1.3.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/any-promise@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm asap is 100.0% likely to have a medium risk anomaly

Notes: Overall, this is a standard asynchronous task scheduler (asap-like) with domain detachment support. There is no inherent malicious behavior, data exfiltration, or backdoor logic present in this fragment. The primary risk is that if an attacker can enqueue untrusted tasks, those tasks could execute arbitrary code in the host environment. Given no external inputs or hardcoded secrets, the code itself is low risk. However, the deprecated domain handling and lazy loading of the domain module should be reviewed in the broader project context for maintainability rather than security threats.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/react-native@0.81.5npm/asap@2.0.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/asap@2.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm cross-spawn is 100.0% likely to have a medium risk anomaly

Notes: This file is a minimal, legitimate wrapper around Node.js child_process.spawn and spawnSync to provide improved ENOENT (command not found) error handling. It does not perform any network requests, dynamic code evaluation, secret disclosure, or telemetry. The only “sink” is the intended execution of local processes as directed by the calling application. No malicious behavior detected.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/expo-linking@7.0.5npm/cross-spawn@7.0.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cross-spawn@7.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm debug is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a benign debug utility (Node.js debug library) used to format and emit colored log messages to standard error based on environment-configured namespaces. It safely handles optional dependencies and avoids dubious data flows or side effects. No evidence of malware, data exfiltration, backdoors, or supply-chain abuse is present in this fragment. Overall security risk is low.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/debug@3.2.7

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/debug@3.2.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm esprima is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a standard Esprima-based esvalidate CLI script intended to parse JavaScript source and report syntax errors. There is no sign of malicious behavior, data exfiltration, hidden backdoors, or crypto/mining activity. Cross-environment shims are notable but do not constitute malicious actions within this isolated snippet. Overall security risk is low, with no clear malware indicators.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/react-native@0.81.5npm/esprima@4.0.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esprima@4.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm foreground-child is 100.0% likely to have a medium risk anomaly

Notes: The code implements a standard watchdog for child-process lifecycle management, aiming to prevent zombie processes when the parent exits. It is not inherently malicious, but reliability hinges on the correctness of the inline watchdog script and proper scoping of the PID. Potential improvements include addressing syntax reliability of the inline code, removing unnecessary no-op keepalive, and ensuring strict validation of the provided PID to mitigate accidental termination of unrelated processes.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo-linking@7.0.5npm/foreground-child@3.3.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/foreground-child@3.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm function-bind is 100.0% likely to have a medium risk anomaly

Notes: The code is a standard Function.prototype.bind polyfill implementation. It carefully handles this binding, constructor behavior, and argument binding without introducing observable malicious behavior. The dynamic Function constructor is used as part of a legitimate polyfill technique and does not indicate an attack by itself in this context.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/util@0.12.5npm/url@0.11.4npm/babel-preset-expo@13.0.0npm/function-bind@1.1.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/function-bind@1.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm gensync is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code fragment appears to be a legitimate implementation of a generator-based synchronization utility (gensync). There is no clear evidence of malicious behavior, data exfiltration, backdoors, or external communications. The security risk is low, with minimal potential for abuse within this isolated fragment. The code is readable and not obfuscated. A minor logic quirk in isIterable should be tracked, but it does not constitute an active security breach.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/@babel/core@7.29.0npm/gensync@1.0.0-beta.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/gensync@1.0.0-beta.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm get-intrinsic is 100.0% likely to have a medium risk anomaly

Notes: The GetIntrinsic module is a conventional intrinsic resolver designed for sandboxed JavaScript environments. It includes careful validation, alias handling, and selective dynamic evaluation for specific intrinsics. While there is a real potential risk from Function-based evaluation if exposed to untrusted input, in this isolated code path there is no evidence of data leakage, backdoors, or external communications. The component is acceptable with proper sandbox boundaries; the most important mitigations are ensuring inputs are trusted and that dynamic evaluation cannot be triggered by untrusted sources.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/util@0.12.5npm/url@0.11.4npm/get-intrinsic@1.3.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/get-intrinsic@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm glob is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a conventional, non-malicious implementation of glob pattern expansion and directory traversal. It reads filesystem data based on user-provided patterns but does not exhibit data exfiltration, remote communications, or code execution risks within this fragment. Overall security risk is low, with standard OS-specific handling for nocase behavior.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo-linking@7.0.5npm/glob@10.5.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@10.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm glob is 100.0% likely to have a medium risk anomaly

Notes: The Glob utilities implement a conventional and well-structured filesystem glob-walking mechanism with robust control flow (abort signals, backpressure) and safe output semantics. There is no evidence of malicious behavior, backdoors, or data exfiltration within this fragment. Risks mainly relate to how downstream consumers may handle emitted paths, not to the library itself.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/glob@13.0.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@13.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm glob is 100.0% likely to have a medium risk anomaly

Notes: The code is a conventional, non-malicious implementation of a globbing helper with ignore pattern support. It reads inputs from configuration and filesystem state, and writes results to an internal cache/result set. There are no indicators of malware or exfiltration within this fragment.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/babel-preset-expo@13.0.0npm/react-native@0.81.5npm/glob@7.2.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@7.2.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm graceful-fs is 100.0% likely to have a medium risk anomaly

Notes: The fragment is a legitimate Graceful FS implementation designed to gracefully handle EMFILE/ENFILE errors by queuing and retrying I/O operations. It coordinates across multiple instances via a shared queue and patches core fs APIs accordingly. Primary risks are complexity and potential unintended interactions in large apps due to global patches, not malicious activity or data exfiltration.

Confidence: 1.00

Severity: 0.60

From: packages/mobile/examples/auth-sign-in/package-lock.jsonnpm/expo@54.0.33npm/expo-linking@7.0.5npm/react-native@0.81.5npm/graceful-fs@4.2.11

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/graceful-fs@4.2.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 22 more rows in the dashboard

View full report

@dylanjeffers dylanjeffers merged commit fa1c0a4 into main Feb 25, 2026
2 checks passed
@dylanjeffers dylanjeffers deleted the mobile-examples branch February 25, 2026 01:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant