Embedded URLs or IPs: npm @types/node
URLs: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray/subarray, 127.0.0.1:8000, process.env.HOST, req.headers.host, https://nodejs.org/docs/latest-v25.x/api/http.html#built-in-proxy-support, https://nodejs.org/docs/latest-v25.x/api/net.html#socketconnectoptions-connectlistener, http://man7.org/linux/man-pages/man2/chown.2.html, http://man7.org/linux/man-pages/man2/chmod.2.html, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/MAX_SAFE_INTEGER, https://developer.mozilla.org/en-US/docs/Web/API/ArrayBufferView, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error, https://docs.microsoft.com/en-us/windows/desktop/FileIO/naming-a-file, https://docs.microsoft.com/en-us/windows/desktop/FileIO/using-streams, http://man7.org/linux/man-pages/man2/readlink.2.html, http://man7.org/linux/man-pages/man2/lstat.2.html, http://man7.org/linux/man-pages/man2/link.2.html, http://man7.org/linux/man-pages/man2/unlink.2.html, https://github.com/mdn/content/pull/38027, https://tc39.github.io/ecma262/#sec-asynciterable-interface, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Iteration_protocols#The_iterable_protocol, http://man7.org/linux/man-pages/man3/opendir.3.html, http://man7.org/linux/man-pages/man3/readdir.3.html, http://man7.org/linux/man-pages/man2/mkdir.2.html, http://man7.org/linux/man-pages/man2/fsync.2.html, http://man7.org/linux/man-pages/man2/pwrite.2.html, fs.read, fs.watch, http://man7.org/linux/man-pages/man2/fdatasync.2.html, https://nodejs.org/docs/latest-v25.x/api/async_hooks.html#promise-execution-tracking, https://nodejs.org/docs/latest-v25.x/api/async_hooks.html#hook-callbacks, https://github.com/tc39/proposal-explicit-resource-management, encrypted.google.com, example.com, github.com, https://encrypted.google.com/, subprocess.channel, http://man7.org/linux/man-pages/man7/signal.7.html, http://man7.org/linux/man-pages/man2/kill.2.html, 74.125.127.100, https://en.wikipedia.org/wiki/List_of_command-line_interpreters, test.sh, http://man7.org/linux/man-pages/man3/exec.3.html, http://man7.org/linux/man-pages/man2/fork.2.html, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Equality, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Inequality, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions, https://nodejs.org/docs/latest-v25.x/api/errors.html#err_invalid_return_value, https://nodejs.org/docs/latest-v25.x/api/errors.html#class-error, https://www.w3.org/TR/html52/changes.html#features-removed, https://nodejs.org/api/buffer.html#buffer_buffers_and_character_encodings, https://nodejs.org/docs/latest-v25.x/api/crypto.html#asymmetric-key-types, https://tools.ietf.org/html/rfc7517, https://www.rfc-editor.org/rfc/rfc5208.txt, https://www.rfc-editor.org/rfc/rfc1421.txt, https://en.wikipedia.org/wiki/Timing_attack, https://en.wikipedia.org/wiki/Initialization_vector, https://www.openssl.org/docs/man3.0/man3/DH_generate_key.html, https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf, https://en.wikipedia.org/wiki/Scrypt, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer, https://www.rfc-editor.org/rfc/rfc4122.txt, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532, https://www.rfc-editor.org/rfc/rfc2818.txt, https://www.rfc-editor.org/rfc/rfc5280.txt, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt, https://www.rfc-editor.org/rfc/rfc9106.html, https://nodejs.org/docs/latest-v25.x/api/crypto.html#using-strings-as-inputs-to-cryptographic-apis, IO.read, https://chromedevtools.github.io/devtools-protocol/v8/, https://docs.libuv.org/en/v1.x/misc.html#c.uv_available_parallelism, https://linux.die.net/man/3/uname, https://en.wikipedia.org/wiki/Uname#Examples, https://nodejs.org/docs/latest-v25.x/api/errors.html#class-systemerror, https://nodejs.org/docs/latest-v25.x/api/process.html#processarch, https://github.com/nodejs/node/blob/HEAD/BUILDING.md#androidandroid-based-devices-eg-firefox-os, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#String_type, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#Number_type, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#Boolean_type, https://www.sqlite.org/lang_attach.html, https://www.sqlite.org/c3ref/c_deterministic.html, https://www.sqlite.org/c3ref/c_directonly.html, https://www.sqlite.org/limits.html#max_function_arg, https://www.sqlite.org/c3ref/sqlite3.html, https://www.sqlite.org/inmemorydb.html, https://www.sqlite.org/c3ref/create_function.html, https://www.sqlite.org/c3ref/close.html, https://www.sqlite.org/c3ref/load_extension.html, https://www.sqlite.org/c3ref/c_dbconfig_defensive.html#sqlitedbconfigdefensive, https://sqlite.org/c3ref/db_filename.html, https://www.sqlite.org/c3ref/exec.html, https://nodejs.org/docs/latest-v25.x/api/sqlite.html#type-conversion-between-javascript-and-sqlite, https://sqlite.org/c3ref/set_authorizer.html, https://sqlite.org/c3ref/get_autocommit.html, https://www.sqlite.org/c3ref/stmt.html, https://www.sqlite.org/c3ref/prepare.html, sqlTagStore.run, sql.run, https://www.sqlite.org/session/sqlite3session_create.html, https://www.sqlite.org/session/sqlite3session_attach.html, https://www.sqlite.org/session/sqlite3changeset_apply.html, https://www.sqlite.org/session/sqlite3session_changeset.html, https://www.sqlite.org/sessionintro.html#changesets_and_patchsets, https://www.sqlite.org/session/sqlite3session_patchset.html, https://www.sqlite.org/session/sqlite3session_delete.html, https://www.sqlite.org/c3ref/column_database_name.html, https://www.sqlite.org/c3ref/column_name.html, https://www.sqlite.org/c3ref/column_decltype.html, https://www.sqlite.org/c3ref/last_insert_rowid.html, https://en.wikipedia.org/wiki/SQL_injection, https://www.sqlite.org/c3ref/bind_blob.html, https://www.sqlite.org/c3ref/expanded_sql.html, https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupinit, https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupstep, https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupfinish, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/length, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DataView, https://developer.mozilla.org/en-US/docs/Web/JavaScript/-, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/JSON/stringify, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray/set, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/indexOf, https://v8docs.nodesource.com/node-13.2/d5/dda/classv8_1_1_isolate.html#a6079122af17612ef54ef3348ce170866, https://nodejs.org/docs/latest-v25.x/api/cli.html#--heapsnapshot-near-heap-limitmax_count, https://www.openssl.org/docs/man1.1.1/man3/SSL_CIPHER_get_name.html, https://tools.ietf.org/html/rfc5929, https://www.openssl.org/docs/man1.1.1/man3/SSL_export_keying_material.html, https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#exporter-labels, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#Undefined_type, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531, options.ca, https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt, https://chromedevtools.github.io/devtools-protocol/1-3/Runtime/#type-ScriptId, https://nodejs.org/docs/latest-v25.x/api/util.html#modifiers, https://github.com/microsoft/TypeScript/issues/12936, 224.0.0.114, 127.0.0.1, 0.0.0.0, https://en.wikipedia.org/wiki/IPv6_address#Scoped_literal_IPv6_addresses, https://tools.ietf.org/html/rfc4007, 10.0.0.2, https://nodejs.org/docs/latest-v25.x/api/async_context.html, https://nodejs.org/docs/latest-v25.x/api/stream.html#streamcomposestreams, readable.map, ws://127.0.0.1:9229/166e272e-7a30-4d09-97ce-f1c012b43c34, https://nodejs.org/en/docs/inspector, app.js.map, nodejs.org, https://nodejs.org/docs/latest-v25.x/api/util.html#utilpromisifyoriginal, https://tools.ietf.org/html/rfc8482, https://nodejs.org/docs/latest-v25.x/api/dns.html#error-codes, https://nodejs.org/docs/latest-v25.x/api/dns.html#dnspromiseslookuphostname-options, https://tools.ietf.org/html/rfc5952#section-6, https://man7.org/linux/man-pages/man5/resolv.conf.5.html, https://datatracker.ietf.org/doc/html/rfc5952#section-6, https://nodejs.org/docs/latest-v25.x/api/cli.html#--dns-result-orderorder, https://nodejs.org/docs/latest-v25.x/api/worker_threads.html, 4.4.4.4, example.org, https://nodejs.org/docs/latest-v25.x/api/child_process.html#optionsstdio, https://man7.org/linux/man-pages/man2/setuid.2.html, https://man7.org/linux/man-pages/man2/setgid.2.html, http://example.org:8000, https://example.org:80, https://example.org/foo/bar, https://example.org, http2stream.id, https://example.com, request.stream, http://example.com, http://example.com/status?name=ryan, https://nodejs.org/docs/latest-v25.x/api/errors.html#class-typeerror, response.stream, https://tools.ietf.org/html/rfc7540, https://http2.github.io/faq/#does-http2-require-encryption, https://nodejs.org/dist/latest-v25.x/docs/api/repl.html#repl_customizing_repl_output, https://nodejs.org/dist/latest-v25.x/docs/api/readline.html#readline_use_of_the_completer_function, https://nodejs.org/dist/latest-v25.x/docs/api/repl.html#repl_class_replserver, https://nodejs.org/dist/latest-v25.x/docs/api/repl.html#repl_commands_and_special_keys, https://nodejs.org/dist/latest-v25.x/docs/api/repl.html#repl_assignment_of_the_underscore_variable, 4.4.4.4:1053, https://nodejs.org/docs/latest-v20.x/api/errors.html#class-error, https://nodejs.org/docs/latest-v20.x/api/dns.html#error-codes, https://nodejs.org/docs/latest-v20.x/api/dns.html#dnspromiseslookuphostname-options, https://nodejs.org/docs/latest-v20.x/api/dns.html#dnspromisessetdefaultresultorderorder, https://nodejs.org/docs/latest-v20.x/api/cli.html#--dns-result-orderorder, https://nodejs.org/docs/latest-v20.x/api/worker_threads.html, https://nodejs.org/docs/latest-v25.x/api/modules.md#loading-ecmascript-modules-using-require, process.report.directory, https://nodejs.org/docs/latest-v25.x/api/cli.html#program-entry-point, https://nodejs.org/docs/latest-v25.x/api/domain.html, https://nodejs.org/docs/latest-v25.x/api/os.html#dlopen-constants, http://man7.org/linux/man-pages/man7/environ.7.html, process.pid, https://docs.libuv.org/en/v1.x/misc.html#c.uv_get_constrained_memory, https://nodejs.org/docs/latest-v25.x/api/process.html#processavailablememory, https://nodejs.org/api/cli.html#--permission, https://nodejs.org/api/permissions.html#permission-model, https://nodejs.org/download/release/v18.12.0/node-v18.12.0.tar.gz, https://nodejs.org/download/release/v18.12.0/node-v18.12.0-headers.tar.gz, https://nodejs.org/download/release/v18.12.0/win-x64/node.lib, https://nodejs.org/docs/latest-v25.x/api/report.html, process.report, https://nodejs.org/docs/latest-v25.x/api/test.html#test-runner-execution-model, https://nodejs.org/docs/latest-v25.x/api/cli.html#--test-update-snapshots, https://nodejs.org/docs/latest-v25.x/api/cli.html#--experimental-test-module-mocks, https://nodejs.org/docs/latest-v25.x/api/module.html#customization-hooks, https://example.com/some/path?page=1&, urlObject.host, urlObject.search, http://example.com/, http://example.com/one, http://example.com/two, https://tools.ietf.org/html/rfc5891#section-4.4, https://nodejs.org/docs/latest-v25.x/api/module.html#module-compile-cache, options.directory, module.id, https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API, https://nodejs.org/docs/latest-v25.x/api/worker_threads.html#worker-threads, 192.168.1.1, 123.123.123.123, 10.0.0.1, 10.0.0.10, 10.0.0.3, 222.111.111.222, 192.168.1.0/24, 10.0.0.5, 127.000.000.001, 127.0.0.1/24, xn--maana-pta.com, ana.com, xn----dqo34k.com, https://nodejs.org/docs/latest-v25.x/api/vm.html#support-of-dynamic-import-in-compilation-apis, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval, https://es5.github.io/#x10.4.2, https://tc39.es/ecma262/#sec-abstract-module-records, https://tc39.es/ecma262/#sec-cyclic-module-records, https://tc39.es/ecma262/#sec-getmodulenamespace, https://tc39.es/ecma262/#sec-moduleevaluation, https://tc39.es/ecma262/#sec-smr-Evaluate, https://heycam.github.io/webidl/#synthetic-module-records
Location: Package overview
From: package.json → npm/@types/node@25.9.1
ℹ Read more on: This package | This alert | What are URL strings?
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@types/node@25.9.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
