fix(fleet): add wheelhouse marker

[John-David Dalton (jdalton)]

Add the missing wheelhouse marker for node-smol so the fleet onboarding check recognizes the local checkout.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​ultrathink/​acorn-wasm@​0.0.1
	pypi/​headroom-ai@​0.30.0
	github/​actions/​download-artifact@​3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	npm/​@​types/​node@​26.1.1
	npm/​regjsparser@​0.13.2
	npm/​@​sinclair/​typebox@​0.34.50
	npm/​compromise@​14.15.1
	npm/​shell-quote@​1.10.0
	npm/​@​socketsecurity/​lib@​6.0.10
	github/​actions/​github-script@​3a2844b7e9c422d3c10d287c895573f7108da1b3
	github/​actions/​upload-artifact@​043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	github/​actions/​checkout@​08c6903cd8c0fde910a37f88322edcfb5dd907a8
	npm/​@​socketregistry/​packageurl-js@​1.4.2
	npm/​@​socketsecurity/​sdk@​4.0.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: pypi grpcio under APSL-2.0 License: APSL-2.0 - The applicable license policy does not permit this license (5) (grpcio-1.78.0/third_party/cares/cares/src/lib/thirdparty/apple/dnsinfo.h) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/grpcio@1.78.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/grpcio@1.78.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi langchain-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langchain-core@1.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/langchain-core@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi langchain-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langchain-core@1.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/langchain-core@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-api under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7/pyproject.toml) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7/PKG-INFO) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7/LICENSE) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-api@0.8.7 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/langgraph-api@0.8.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-api under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7.dist-info/METADATA) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (LICENSE) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7.dist-info/licenses/LICENSE) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-api@0.8.7 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/langgraph-api@0.8.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-runtime-inmem under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_runtime_inmem-0.28.1/pyproject.toml) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_runtime_inmem-0.28.1/PKG-INFO) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-runtime-inmem@0.28.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/langgraph-runtime-inmem@0.28.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-runtime-inmem under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_runtime_inmem-0.28.1.dist-info/METADATA) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-runtime-inmem@0.28.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/langgraph-runtime-inmem@0.28.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi orjson is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/orjson@3.11.9 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/orjson@3.11.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi orjson License: Apache-2.0 WITH LLVM-exception - The applicable license policy does not permit this license (5) (orjson-3.11.9/include/cargo/target-lexicon-0.13.5/LICENSE) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/orjson@3.11.9 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/orjson@3.11.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi pycparser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/pycparser@3.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/pycparser@3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi pycparser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/pycparser@3.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/pycparser@3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi pyreadline3 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/pyreadline3@3.5.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/pyreadline3@3.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi pyreadline3 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/pyreadline3@3.5.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/pyreadline3@3.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​ultrathink/​acorn-wasm@​0.0.1
	pypi/​headroom-ai@​0.30.0
	npm/​@​types/​node@​26.1.1
	github/​actions/​checkout@​08c6903cd8c0fde910a37f88322edcfb5dd907a8
	npm/​regjsparser@​0.13.2
	npm/​compromise@​14.15.1
	npm/​@​sinclair/​typebox@​0.34.50
	npm/​shell-quote@​1.10.0
	npm/​@​socketsecurity/​lib@​6.0.10
	npm/​@​socketregistry/​packageurl-js@​1.4.2
	npm/​@​socketsecurity/​sdk@​4.0.1

View full report

[socket-security-staging]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Malicious package: pypi fastapi Note: Malicious code in fastapi (PyPI) Source: amazon-inspector (a753fd569a7bb908b7cdf82fe0228dc0e24dcc253b67993af5dd5c30b61f4411) This release of fastapi 0.136.3 modifies pyproject.toml and PKG-INFO to add an undocumented dependency 'fastar>=0.9.0' to the [project.optional-dependencies] standard group (pyproject.toml line 67: "fastar >= 0.9.0",; PKG-INFO line 47: Requires-Dist: fastar>=0.9.0; extra == "standard"). The README documents every other dependency in the [standard] group (httpx, jinja2, python-multipart, uvicorn, fastapi-cli, email-validator, pydantic-settings, pydantic-extra-types) but does not mention 'fastar'. Because the documented recommended install command is pip install "fastapi[standard]", every user following the official documentation silently pulls the unrelated 'fastar' package onto their developer or CI machine. The name 'fastar' is a typosquat-shaped substitution against 'fastapi'/'fastapi-*' namespaces, and its insertion into the canonical install path of one of PyPI's most-installed web frameworks constitutes a dependency-confusion / namespace-abuse vector regardless of what 'fastar' currently contains. Whoever controls 'fastar' on PyPI gains code execution at install time on a very large user base. From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/fastapi@0.136.3 ℹ Read more on: This package | This alert | What is known malware? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is strongly recommended that malware is removed from your codebase. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/fastapi@0.136.3. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi grpcio-tools is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/grpcio-tools@1.78.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/grpcio-tools@1.78.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi grpcio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/grpcio@1.78.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/grpcio@1.78.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi grpcio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/grpcio@1.78.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/grpcio@1.78.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi headroom-ai is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/pyproject.toml → pypi/headroom-ai@0.30.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/headroom-ai@0.30.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-api under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7/pyproject.toml) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7/PKG-INFO) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7/LICENSE) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-api@0.8.7 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/langgraph-api@0.8.7. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-api under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7.dist-info/METADATA) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (LICENSE) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_api-0.8.7.dist-info/licenses/LICENSE) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-api@0.8.7 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/langgraph-api@0.8.7. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-runtime-inmem under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_runtime_inmem-0.28.1/pyproject.toml) License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_runtime_inmem-0.28.1/PKG-INFO) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-runtime-inmem@0.28.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/langgraph-runtime-inmem@0.28.1. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi langgraph-runtime-inmem under Elastic-2.0 License: Elastic-2.0 - The applicable license policy does not permit this license (5) (langgraph_runtime_inmem-0.28.1.dist-info/METADATA) From: .claude/hooks/fleet/setup-security-tools/skillspector/uv.lock → pypi/langgraph-runtime-inmem@0.28.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/langgraph-runtime-inmem@0.28.1. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: MCP Python SDK: WebSocket server transport does not support Host/Origin validation CVE: GHSA-vj7q-gjh5-988w MCP Python SDK: WebSocket server transport does not support Host/Origin validation (HIGH) Affected versions: < 1.28.1 Patched version: 1.28.1 From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/mcp@1.27.2 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/mcp@1.27.2. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: pypi numpy Note: The script poses a potential security risk due to the lack of input validation and may lead to arbitrary code execution or unauthorized access. Further investigation and validation are necessary. From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.2.6 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.2.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi numpy under FSFAP License: FSFAP - The applicable license policy does not permit this license (5) (numpy-2.2.6/vendored-meson/meson/test cases/frameworks/6 gettext/data3/metainfo.its) From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.2.6 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.2.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: pypi numpy Note: The script poses a potential security risk due to the lack of input validation and may lead to arbitrary code execution or unauthorized access. Further investigation and validation are necessary. From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi numpy under FSFAP License: FSFAP - The applicable license policy does not permit this license (5) (numpy-2.4.6/vendored-meson/meson/test cases/frameworks/6 gettext/data3/metainfo.its) From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi numpy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: .claude/hooks/fleet/setup-security-tools/headroom/uv.lock → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 37 more rows in the dashboard

View full report