chore(deps): bump the metamask-non-major group across 1 directory with 12 updates - #11244

Author: boneskull

From: packages/account-tree-controller/package.json → npm/@metamask/snaps-utils@12.6.1 → npm/@endo/immutable-arraybuffer@2.0.0

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@endo/immutable-arraybuffer@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: This module is a high-impact evaluator/engine component that dynamically compiles code and executes caller-provided strings via eval(arguments[0]) within multiple nested with scope wrappers. There are no obvious explicit malicious payloads (exfiltration/network/persistence) in this file, but it provides a powerful arbitrary code execution mechanism whenever untrusted input reaches the evaluated string or the generated scope bindings. Strong input trust boundaries and sandboxing/permission controls are required for safe use.

Confidence: 0.72

Severity: 0.78

From: packages/account-tree-controller/package.json → npm/@metamask/snaps-utils@12.6.1 → npm/ses@2.3.0

ℹ Read more on: This package | This alert | What are AI-detected potential security risks?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ses@2.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

New Author: boneskull

Previous Author: kriskowal

From: packages/account-tree-controller/package.json → npm/@metamask/snaps-utils@12.6.1 → npm/@endo/immutable-arraybuffer@2.0.0

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@endo/immutable-arraybuffer@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Install script: preinstall

Source: echo "Don't run npm lifecycle scripts by default! Use @lavamoat.harden to configure the project. (The presence of preinstall-always-fail might mean a secure configuration existed and was corrupted)" && exit 1

From: package.json → npm/@lavamoat/preinstall-always-fail@3.0.1

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lavamoat/preinstall-always-fail@3.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Notes: This module implements a Function-constructor-like capability that converts caller-provided runtime arguments into JavaScript source code (parameters and body) and then compiles/executes it through an injected evaluator. No explicit exfiltration or system-interaction behavior is present in the fragment, but the untrusted-input-to-dynamic-evaluation pathways are inherently high risk if inputs are not strictly controlled and if the evaluator does not enforce strong isolation and policy.

Confidence: 0.65

Severity: 0.62

From: packages/account-tree-controller/package.json → npm/@metamask/snaps-utils@12.6.1 → npm/ses@2.3.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ses@2.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.