chore: bump ESLint stack to v15 and migrate to flat config

[cryptodev-2s]

Stacked on #314.

Replaces .eslintrc.js with a flat eslint.config.mjs and moves the ESLint stack to core's versions.

Dep	From	To
eslint	^8.44.0	^9.39.1
@metamask/eslint-config{,-jest,-nodejs,-typescript}	^12.0.0	^15.0.0
@metamask/auto-changelog	^3.1.0	^6.1.0
eslint-plugin-jest	^27.2.2	^28.8.3
eslint-plugin-jsdoc	^39.9.1	^50.2.4
eslint-plugin-n	^15.7.0	^17.10.3
eslint-plugin-promise	^6.1.1	^7.1.0

Drops eslint-plugin-import and @typescript-eslint/{parser,eslint-plugin} for eslint-plugin-import-x and typescript-eslint. Adds @types/semver@^7, which had been arriving transitively through @typescript-eslint/eslint-plugin and broke the build once that was removed.

Config v15 surfaced 351 problems v12 never enforced. Stylistic ones are off with TODO comments, matching core. The rest were stale directives naming rules that typescript-eslint v8 renamed or removed, so the code under them was going unchecked:

Directive	Fate	Sites
@typescript-eslint/no-throw-literal	renamed to only-throw-error	8
@typescript-eslint/ban-types	split in v8, no longer needed here	3
import/no-nodejs-modules	now import-x/no-nodejs-modules	1 block
jest/no-if	removed in eslint-plugin-jest v28	1

Two autofixes are reverted because they changed behaviour rather than style:

1. hasProperty's constraint was rewritten from Object to object. The original carried an explicit suppression, so Object was deliberate: it accepts boxed primitives, and narrowing it breaks callers passing a string or number.
2. json.test-d.ts lost as any and as number | undefined from its tsd assertions. In type tests the assertion is the test. no-unnecessary-type-assertion is now off for *.test-d.ts.

jsdoc/require-jsdoc stays off rather than suppressed: its autofixer inserted 193 empty JSDoc blocks on the first pass. Core disables it for the same reason.

---

Note

Low Risk
Tooling and lint-only source edits with no runtime API changes beyond type-only export syntax; main risk is CI/lint drift if config overrides hide real issues.

Overview
Migrates linting from .eslintrc.js to ESLint 9 flat config (eslint.config.mjs), bumps @metamask/eslint-config and related plugins to v15, and aligns dependencies with core ( eslint-plugin-import-x, typescript-eslint, drops legacy @typescript-eslint/* packages). lint:eslint no longer passes --ext; @types/semver is added explicitly after the TS-eslint dependency chain went away.

The new config turns off several JSDoc and TypeScript rules that v15 newly enforces (with TODOs), ignores uuid for import-x, disables no-unnecessary-type-assertion in *.test-d.ts, and relaxes Node builtin checks in tests that polyfill crypto.

Across src/, changes are mostly lint compliance: updated disable comments for renamed/removed rules, import-x/no-nodejs-modules, export type * for type-only modules, small typing/import cleanups, and preserving intentional behavior (e.g. hasProperty still uses Object, tsd assertions kept intact).

^{Reviewed by Cursor Bugbot for commit cb576bc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint@​8.45.0 ⏵ 9.39.5
	@​types/​semver@​7.3.13 ⏵ 7.8.0				+5
	typescript-eslint@​8.69.0
	@​metamask/​eslint-config-jest@​12.1.0 ⏵ 15.0.1			+5	+8
	eslint-plugin-promise@​6.1.1 ⏵ 7.3.0
	debug@​3.2.7 ⏵ 4.4.3	+1		+1
	eslint-import-resolver-typescript@​3.10.1
	@​metamask/​eslint-config@​12.2.0 ⏵ 15.0.1			+3	+8
	@​metamask/​eslint-config-nodejs@​12.1.0 ⏵ 15.0.1			+3	+8
	@​metamask/​eslint-config-typescript@​12.1.0 ⏵ 15.0.1			+2	+8
	eslint-plugin-import-x@​4.17.1
	eslint-plugin-n@​15.7.0 ⏵ 17.24.0				-3
	@​metamask/​auto-changelog@​3.4.4 ⏵ 6.2.1			+1	+6
	eslint-plugin-jsdoc@​39.9.1 ⏵ 50.8.0			+1	+1
	eslint-plugin-jest@​27.2.3 ⏵ 28.14.0	+1		+1	+3

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		System shell access: npm napi-postinstall in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/napi-postinstall@0.3.4 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm unrs-resolver in module child_process Module: child_process Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/unrs-resolver@1.12.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unrs-resolver@1.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @emnapi/core in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @octokit/request in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/@metamask/auto-changelog@6.2.1 → npm/@octokit/request@8.4.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@octokit/request@8.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm @tybys/wasm-util in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@tybys/wasm-util@0.10.3 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm eslint-plugin-n in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/eslint-plugin-n@17.24.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-n@17.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm napi-postinstall in module node:http Module: node:http Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/napi-postinstall@0.3.4 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm napi-postinstall in module node:https Module: node:https Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/napi-postinstall@0.3.4 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Network access: npm napi-postinstall in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/napi-postinstall@0.3.4 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/napi-postinstall@0.3.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Install-time scripts: npm unrs-resolver during postinstall Install script: postinstall Source: node postinstall.js From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/unrs-resolver@1.12.2 ℹ Read more on: This package | This alert | What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/unrs-resolver@1.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly Notes: No overt data theft, network exfiltration, cryptomining, or backdoor installation is visible. However, the module includes strong dynamic execution sinks: napi_run_script uses g.eval(...) and emnapiCreateFunction uses new Function(...) to create named wrappers. These are high-risk patterns in supply-chain reviews; if the parent project exposes these APIs to untrusted input (directly or indirectly from Wasm), it could enable arbitrary code execution. The rest of the code is largely Wasm memory/handle marshaling typical of N-API glue runtimes. Confidence: 0.62 Severity: 0.55 From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 62.0% likely to have a medium risk anomaly Notes: Primary concern is direct dynamic code execution. napi_run_script uses eval() on a string originating from wasm-provided input, and ee uses new Function(...) to construct wrapper functions. If the wasm module or its inputs are attacker-controlled, this provides JavaScript code execution in the host context. Aside from these dynamic execution sinks, the remaining code mainly performs wasm memory/table management and worker async orchestration typical of such runtimes, with no clear hardcoded exfiltration or backdoor behavior in this fragment. Confidence: 0.62 Severity: 0.68 From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 66.0% likely to have a medium risk anomaly Notes: No explicit evidence of overt malware (network exfiltration, credential theft, backdoors, or filesystem/process activity) appears in this fragment. However, the module contains high-sensitivity dynamic execution capabilities: napi_run_script performs eval-like execution of a JavaScript string obtained from WebAssembly, and emnapiCreateFunction can use the Function constructor for wrapper generation. Combined with wasm-driven indirect callback dispatch and reflective object mutation, this runtime is security-sensitive and should only be used with fully trusted WebAssembly and tightly controlled inputs. Confidence: 0.66 Severity: 0.66 From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @emnapi/core is 66.0% likely to have a medium risk anomaly Notes: This module appears to be a legitimate wasm-to-JS/Node-API bridge/runtime, but it contains high-impact dynamic execution capabilities: napi_run_script uses eval() on a string originating from the WASM/handle side, and the binding layer can generate functions via new Function(). It also performs indirect host callback invocation based on runtime handles selected by worker/work-queue control. No explicit exfiltration/backdoor behavior is visible in the provided fragment, so malware likelihood is low, but security risk is moderate-to-high due to host-context code execution if the WASM module or its inputs are not fully trusted. Confidence: 0.66 Severity: 0.68 From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @emnapi/core reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/core@1.10.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @emnapi/runtime reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/runtime@1.10.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @emnapi/wasi-threads reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@emnapi/wasi-threads@1.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/wasi-threads@1.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @metamask/auto-changelog Location: Package overview From: package.json → npm/@metamask/auto-changelog@6.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@6.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @metamask/auto-changelog reads npm_package_repository_url Env Vars: npm_package_repository_url Location: Package overview From: package.json → npm/@metamask/auto-changelog@6.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@6.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @metamask/auto-changelog reads PROJECT_CWD Env Vars: PROJECT_CWD Location: Package overview From: package.json → npm/@metamask/auto-changelog@6.2.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/auto-changelog@6.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm @tybys/wasm-util is 65.0% likely to have a medium risk anomaly Notes: No direct evidence of intentional malware, obfuscation-based payload hiding, or covert network exfiltration in this fragment. The primary security concerns are design/capability risks typical of WASI runtimes: executing externally provided WASM, high-impact filesystem access via injected fs/preopens, environment-variable exposure to the guest, possible host termination via proc_exit, and non-malicious operational risks (busy-wait timer handling and window.prompt stdin blocking; weak RNG fallback to Math.random). Risk is therefore configuration- and trust-boundary-dependent rather than a confirmed implant. Confidence: 0.65 Severity: 0.52 From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@tybys/wasm-util@0.10.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @tybys/wasm-util Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@tybys/wasm-util@0.10.3 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @tybys/wasm-util reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@tybys/wasm-util@0.10.3 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm @tybys/wasm-util reads NODE_DEBUG_NATIVE Env Vars: NODE_DEBUG_NATIVE Location: Package overview From: package.json → npm/eslint-plugin-import-x@4.17.1 → npm/eslint-import-resolver-typescript@3.10.1 → npm/@tybys/wasm-util@0.10.3 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 20 more rows in the dashboard

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6551ea9. Configure here.}