translations.json

{
  "alerts": {
    "badEncoding": {
      "description": "Source files are encoded using a non-standard text encoding.",
      "suggestion": "Ensure all published files are encoded using a standard encoding such as UTF8, UTF16, UTF32, SHIFT-JIS, etc.",
      "title": "Bad text encoding",
      "emoji": "⚠️"
    },
    "badSemver": {
      "description": "Package version is not a valid semantic version (semver).",
      "suggestion": "All versions of all packages on npm should use use a valid semantic version. Publish a new version of the package with a valid semantic version. Semantic version ranges do not work with invalid semantic versions.",
      "title": "Bad semver",
      "emoji": "⚠️"
    },
    "badSemverDependency": {
      "description": "Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.",
      "suggestion": "Switch to a version of the dependency with valid semver or override the dependency version if it is determined to be problematic.",
      "title": "Bad dependency semver",
      "emoji": "⚠️"
    },
    "bidi": {
      "description": "Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.",
      "suggestion": "Remove bidirectional unicode control characters, or clearly document what they are used for.",
      "title": "Bidirectional unicode control characters",
      "emoji": "⚠️"
    },
    "binScriptConfusion": {
      "description": "This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.",
      "suggestion": "Consider removing one of the conflicting packages. Packages should only export bin scripts with their name.",
      "title": "Bin script confusion",
      "emoji": "😵‍💫"
    },
    "chronoAnomaly": {
      "description": "Semantic versions published out of chronological order.",
      "suggestion": "This could either indicate dependency confusion or a patched vulnerability.",
      "title": "Chronological version anomaly",
      "emoji": "⚠️"
    },
    "compromisedSSHKey": {
      "description": "Project maintainer's SSH key has been compromised.",
      "suggestion": "The maintainer should revoke the compromised key and generate a new one.",
      "title": "Compromised SSH key",
      "emoji": "🔑"
    },
    "criticalCVE": {
      "description": "Contains a Critical Common Vulnerability and Exposure (CVE).",
      "suggestion": "Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.",
      "title": "Critical CVE",
      "emoji": "⚠️"
    },
    "cve": {
      "description": "Contains a high severity Common Vulnerability and Exposure (CVE).",
      "suggestion": "Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.",
      "title": "High CVE",
      "emoji": "⚠️"
    },
    "debugAccess": {
      "description": "Uses debug, reflection and dynamic code execution features.",
      "suggestion": "Removing the use of debug will reduce the risk of any reflection and dynamic code execution.",
      "title": "Debug access",
      "emoji": "⚠️"
    },
    "deprecated": {
      "description": "The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.",
      "suggestion": "Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution.",
      "title": "Deprecated",
      "emoji": "⚠️"
    },
    "deprecatedException": {
      "description": "(Experimental) Contains a known deprecated SPDX license exception.",
      "suggestion": "Fix the license so that it no longer contains deprecated SPDX license exceptions.",
      "title": "Deprecated SPDX exception",
      "emoji": "⚠️"
    },
    "explicitlyUnlicensedItem": {
      "description": "(Experimental) Something was found which is explicitly marked as unlicensed.",
      "suggestion": "Manually review your policy on such materials",
      "title": "Explicitly Unlicensed Item",
      "emoji": "⚠️"
    },
    "unidentifiedLicense": {
      "description": "(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license.",
      "suggestion": "Manually review the license contents.",
      "title": "Unidentified License",
      "emoji": "⚠️"
    },
    "noLicenseFound": {
      "description": "(Experimental) License information could not be found.",
      "suggestion": "Manually review the licensing",
      "title": "No License Found",
      "emoji": "⚠️"
    },
    "copyleftLicense": {
      "description": "(Experimental) Copyleft license information was found.",
      "suggestion": "Determine whether use of copyleft material works for you",
      "title": "Copyleft License",
      "emoji": "⚠️"
    },
    "licenseSpdxDisj": {
      "description": "This package is not allowed per your license policy. Review the package's license to ensure compliance.",
      "suggestion": "Find a package that does not violate your license policy or adjust your policy to allow this package's license.",
      "title": "License Policy Violation",
      "emoji": "⚠️"
    },
    "nonpermissiveLicense": {
      "description": "(Experimental) A license not known to be considered permissive was found.",
      "suggestion": "Determine whether use of material not offered under a known permissive license works for you",
      "title": "Non-permissive License",
      "emoji": "⚠️"
    },
    "miscLicenseIssues": {
      "description": "(Experimental) A package's licensing information has fine-grained problems.",
      "suggestion": "Consult the alert's description and location information for more information",
      "title": "Misc. License Issues",
      "emoji": "⚠️"
    },
    "deprecatedLicense": {
      "description": "(Experimental) License is deprecated which may have legal implications regarding the package's use.",
      "suggestion": "Update or change the license to a well-known or updated license.",
      "title": "Deprecated license",
      "emoji": "⚠️"
    },
    "didYouMean": {
      "description": "Package name is similar to other popular packages and may not be the package you want.",
      "suggestion": "Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.",
      "title": "Possible typosquat attack",
      "emoji": "🧐"
    },
    "dynamicRequire": {
      "description": "Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.",
      "suggestion": "Packages should avoid dynamic imports when possible. Audit the use of dynamic require to ensure it is not executing malicious or vulnerable code.",
      "title": "Dynamic require",
      "emoji": "⚠️"
    },
    "emptyPackage": {
      "description": "Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.",
      "suggestion": "Remove dependencies that do not export any code or functionality and ensure the package version includes all of the files it is supposed to.",
      "title": "Empty package",
      "emoji": "⚠️"
    },
    "envVars": {
      "description": "Package accesses environment variables, which may be a sign of credential stuffing or data theft.",
      "suggestion": "Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to.",
      "title": "Environment variable access",
      "emoji": "⚠️"
    },
    "extraneousDependency": {
      "description": "Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.",
      "suggestion": "Specify all optionally loaded dependencies in optionalDependencies within package.json.",
      "title": "Extraneous dependency",
      "emoji": "⚠️"
    },
    "fileDependency": {
      "description": "Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.",
      "suggestion": "Remove the dependency specified by a file resolution string from package.json and update any bare name imports that referenced it before to use relative path strings.",
      "title": "File dependency",
      "emoji": "⚠️"
    },
    "filesystemAccess": {
      "description": "Accesses the file system, and could potentially read sensitive data.",
      "suggestion": "If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.",
      "title": "Filesystem access",
      "emoji": "⚠️"
    },
    "floatingDependency": {
      "description": "Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.",
      "suggestion": "Packages should specify properly semver ranges to avoid version conflicts.",
      "title": "Wildcard dependency",
      "emoji": "🎈"
    },
    "gitDependency": {
      "description": "Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.",
      "suggestion": "Publish the git dependency to npm or a private package repository and consume it from there.",
      "title": "Git dependency",
      "emoji": "🍣"
    },
    "gitHubDependency": {
      "description": "Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.",
      "suggestion": "Publish the GitHub dependency to npm or a private package repository and consume it from there.",
      "title": "GitHub dependency",
      "emoji": "⚠️"
    },
    "gptAnomaly": {
      "description": "AI has identified unusual behaviors that may pose a security risk.",
      "suggestion": "An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.",
      "title": "AI-detected potential code anomaly",
      "emoji": "🤔"
    },
    "gptDidYouMean": {
      "description": "AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.",
      "suggestion": "Given the AI system's identification of this package as a potential typosquat, please verify that you did not intend to install a different package. Be cautious, as malicious packages often use names similar to popular ones.",
      "title": "AI-detected possible typosquat",
      "emoji": "🤖"
    },
    "gptMalware": {
      "description": "AI has identified this package as malware. This is a strong signal that the package may be malicious.",
      "suggestion": "Given the AI system's identification of this package as malware, extreme caution is advised. It is recommended to avoid downloading or installing this package until the threat is confirmed or flagged as a false positive.",
      "title": "AI-detected potential malware",
      "emoji": "🤖"
    },
    "gptSecurity": {
      "description": "AI has determined that this package may contain potential security issues or vulnerabilities.",
      "suggestion": "An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture.",
      "title": "AI-detected potential security risk",
      "emoji": "🤖"
    },
    "hasNativeCode": {
      "description": "Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.",
      "suggestion": "Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks.",
      "title": "Native code",
      "emoji": "🛠️"
    },
    "highEntropyStrings": {
      "description": "Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.",
      "suggestion": "Please inspect these strings to check if these strings are benign. Maintainers should clarify the purpose and existence of high entropy strings if there is a legitimate purpose.",
      "title": "High entropy strings",
      "emoji": "⚠️"
    },
    "homoglyphs": {
      "description": "Contains unicode homoglyphs which can be used in supply chain confusion attacks.",
      "suggestion": "Remove unicode homoglyphs if they are unnecessary, and audit their presence to confirm legitimate use.",
      "title": "Unicode homoglyphs",
      "emoji": "⚠️"
    },
    "httpDependency": {
      "description": "Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.",
      "suggestion": "Publish the HTTP URL dependency to npm or a private package repository and consume it from there.",
      "title": "HTTP dependency",
      "emoji": "🥩"
    },
    "installScripts": {
      "description": "Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.",
      "suggestion": "Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.",
      "title": "Install scripts",
      "emoji": "📜"
    },
    "invalidPackageJSON": {
      "description": "Package has an invalid manifest file and can cause installation problems if you try to use it.",
      "suggestion": "Fix syntax errors in the manifest file and publish a new version. Consumers can use npm overrides to force a version that does not have this problem if one exists.",
      "title": "Invalid manifest file",
      "emoji": "🤒"
    },
    "invisibleChars": {
      "description": "Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.",
      "suggestion": "Remove invisible characters. If their use is justified, use their visible escaped counterparts.",
      "title": "Invisible chars",
      "emoji": "⚠️"
    },
    "licenseChange": {
      "description": "(Experimental) Package license has recently changed.",
      "suggestion": "License changes should be reviewed carefully to inform ongoing use. Packages should avoid making major changes to their license type.",
      "title": "License change",
      "emoji": "⚠️"
    },
    "licenseException": {
      "description": "(Experimental) Contains an SPDX license exception.",
      "suggestion": "License exceptions should be carefully reviewed.",
      "title": "License exception",
      "emoji": "⚠️"
    },
    "longStrings": {
      "description": "Contains long string literals, which may be a sign of obfuscated or packed code.",
      "suggestion": "Avoid publishing or consuming obfuscated or bundled code. It makes dependencies difficult to audit and undermines the module resolution system.",
      "title": "Long strings",
      "emoji": "⚠️"
    },
    "missingTarball": {
      "description": "This package is missing it's tarball. It could be removed from the npm registry or there may have been an error when publishing.",
      "suggestion": "This package cannot be analyzed or installed due to missing data.",
      "title": "Missing package tarball",
      "emoji": "❔"
    },
    "majorRefactor": {
      "description": "Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.",
      "suggestion": "Consider waiting before upgrading to see if any issues are discovered, or be prepared to scrutinize any bugs or subtle changes the major refactor may bring. Publishers my consider publishing beta versions of major refactors to limit disruption to parties interested in the new changes.",
      "title": "Major refactor",
      "emoji": "⚠️"
    },
    "malware": {
      "description": "This package is malware. We have asked the package registry to remove it.",
      "title": "Known malware",
      "suggestion": "It is strongly recommended that malware is removed from your codebase.",
      "emoji": "☠️"
    },
    "manifestConfusion": {
      "description": "This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.",
      "title": "Manifest confusion",
      "suggestion": "Packages with inconsistent metadata may be corrupted or malicious.",
      "emoji": "🥸"
    },
    "mediumCVE": {
      "description": "Contains a medium severity Common Vulnerability and Exposure (CVE).",
      "suggestion": "Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.",
      "title": "Medium CVE",
      "emoji": "⚠️"
    },
    "mildCVE": {
      "description": "Contains a low severity Common Vulnerability and Exposure (CVE).",
      "suggestion": "Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.",
      "title": "Low CVE",
      "emoji": "⚠️"
    },
    "minifiedFile": {
      "description": "This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.",
      "suggestion": "In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm.",
      "title": "Minified code",
      "emoji": "⚠️"
    },
    "missingAuthor": {
      "description": "The package was published by an npm account that no longer exists.",
      "suggestion": "Packages should have active and identified authors.",
      "title": "Non-existent author",
      "emoji": "🫥"
    },
    "missingDependency": {
      "description": "A required dependency is not declared in package.json and may prevent the package from working.",
      "suggestion": "The package should define the missing dependency inside of package.json and publish a new version. Consumers may have to install the missing dependency themselves as long as the dependency remains missing. If the dependency is optional, add it to optionalDependencies and handle the missing case.",
      "title": "Missing dependency",
      "emoji": "⚠️"
    },
    "missingLicense": {
      "description": "(Experimental) Package does not have a license and consumption legal status is unknown.",
      "suggestion": "A new version of the package should be published that includes a valid SPDX license in a license file, package.json license field or mentioned in the README.",
      "title": "Missing license",
      "emoji": "⚠️"
    },
    "mixedLicense": {
      "description": "(Experimental) Package contains multiple licenses.",
      "suggestion": "A new version of the package should be published that includes a single license. Consumers may seek clarification from the package author. Ensure that the license details are consistent across the LICENSE file, package.json license field and license details mentioned in the README.",
      "title": "Mixed license",
      "emoji": "⚠️"
    },
    "ambiguousClassifier": {
      "description": "(Experimental) An ambiguous license classifier was found.",
      "suggestion": "A specific license or licenses should be identified",
      "title": "Ambiguous License Classifier",
      "emoji": "⚠️"
    },
    "modifiedException": {
      "description": "(Experimental) Package contains a modified version of an SPDX license exception. Please read carefully before using this code.",
      "suggestion": "Packages should avoid making modifications to standard license exceptions.",
      "title": "Modified license exception",
      "emoji": "⚠️"
    },
    "modifiedLicense": {
      "description": "(Experimental) Package contains a modified version of an SPDX license. Please read carefully before using this code.",
      "suggestion": "Packages should avoid making modifications to standard licenses.",
      "title": "Modified license",
      "emoji": "⚠️"
    },
    "networkAccess": {
      "description": "This module accesses the network.",
      "suggestion": "Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.",
      "title": "Network access",
      "emoji": "⚠️"
    },
    "newAuthor": {
      "description": "A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.",
      "suggestion": "Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.",
      "title": "New author",
      "emoji": "⚠️"
    },
    "noAuthorData": {
      "description": "Package does not specify a list of contributors or an author in package.json.",
      "suggestion": "Add a author field or contributors array to package.json.",
      "title": "No contributors or author data",
      "emoji": "⚠️"
    },
    "noBugTracker": {
      "description": "Package does not have a linked bug tracker in package.json.",
      "suggestion": "Add a bugs field to package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#bugs",
      "title": "No bug tracker",
      "emoji": "⚠️"
    },
    "noREADME": {
      "description": "Package does not have a README. This may indicate a failed publish or a low quality package.",
      "suggestion": "Add a README to to the package and publish a new version.",
      "title": "No README",
      "emoji": "⚠️"
    },
    "noRepository": {
      "description": "Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.",
      "suggestion": "Add a repository field to package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#repository",
      "title": "No repository",
      "emoji": "⚠️"
    },
    "noTests": {
      "description": "Package does not have any tests. This is a strong signal of a poorly maintained or low quality package.",
      "suggestion": "Add tests and publish a new version of the package. Consumers may look for an alternative package with better testing.",
      "title": "No tests",
      "emoji": "⚠️"
    },
    "noV1": {
      "description": "Package is not semver >=1. This means it is not stable and does not support ^ ranges.",
      "suggestion": "If the package sees any general use, it should begin releasing at version 1.0.0 or later to benefit from semver.",
      "title": "No v1",
      "emoji": "⚠️"
    },
    "noWebsite": {
      "description": "Package does not have a website.",
      "suggestion": "Add a homepage field to package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#homepage",
      "title": "No website",
      "emoji": "⚠️"
    },
    "nonFSFLicense": {
      "description": "(Experimental) Package has a non-FSF-approved license.",
      "title": "Non FSF license",
      "suggestion": "Consider the terms of the license for your given use case.",
      "emoji": "⚠️"
    },
    "nonOSILicense": {
      "description": "(Experimental) Package has a non-OSI-approved license.",
      "title": "Non OSI license",
      "suggestion": "Consider the terms of the license for your given use case.",
      "emoji": "⚠️"
    },
    "nonSPDXLicense": {
      "description": "(Experimental) Package contains a non-standard license somewhere. Please read carefully before using.",
      "suggestion": "Package should adopt a standard SPDX license consistently across all license locations (LICENSE files, package.json license fields, and READMEs).",
      "title": "Non SPDX license",
      "emoji": "⚠️"
    },
    "notice": {
      "description": "(Experimental) Package contains a legal notice. This could increase your exposure to legal risk when using this project.",
      "title": "Legal notice",
      "suggestion": "Consider the implications of the legal notice for your given use case.",
      "emoji": "⚠️"
    },
    "obfuscatedFile": {
      "description": "Obfuscated files are intentionally packed to hide their behavior. This could be a sign of malware.",
      "suggestion": "Packages should not obfuscate their code. Consider not using packages with obfuscated code",
      "title": "Obfuscated code",
      "emoji": "⚠️"
    },
    "obfuscatedRequire": {
      "description": "Package accesses dynamic properties of require and may be obfuscating code execution.",
      "suggestion": "The package should not access dynamic properties of module. Instead use import or require directly.",
      "title": "Obfuscated require",
      "emoji": "⚠️"
    },
    "peerDependency": {
      "description": "Package specifies peer dependencies in package.json.",
      "suggestion": "Peer dependencies are fragile and can cause major problems across version changes. Be careful when updating this dependency and its peers.",
      "title": "Peer dependency",
      "emoji": "⚠️"
    },
    "potentialVulnerability": {
      "description": "Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.",
      "suggestion": "It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches.",
      "title": "Potential vulnerability",
      "emoji": "🚧"
    },
    "semverAnomaly": {
      "description": "Package semver skipped several versions, this could indicate a dependency confusion attack or indicate the intention of disruptive breaking changes or major priority shifts for the project.",
      "suggestion": "Packages should follow semantic versions conventions by not skipping subsequent version numbers. Consumers should research the purpose of the skipped version number.",
      "title": "Semver anomaly",
      "emoji": "⚠️"
    },
    "shellAccess": {
      "description": "This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.",
      "suggestion": "Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.",
      "title": "Shell access",
      "emoji": "⚠️"
    },
    "shellScriptOverride": {
      "description": "This package re-exports a well known shell command via an npm bin script. This is possibly a supply chain attack.",
      "suggestion": "Packages should not export bin scripts which conflict with well known shell commands",
      "title": "Bin script shell injection",
      "emoji": "🦀"
    },
    "shrinkwrap": {
      "description": "Package contains a shrinkwrap file. This may allow the package to bypass normal install procedures.",
      "suggestion": "Packages should never use npm shrinkwrap files due to the dangers they pose.",
      "title": "NPM Shrinkwrap",
      "emoji": "🧊"
    },
    "socketUpgradeAvailable": {
      "description": "Package can be replaced with a Socket optimized override.",
      "suggestion": "Run `npx socket optimize` in your repository to optimize your dependencies.",
      "title": "Socket optimized override available",
      "emoji": "🔄"
    },
    "suspiciousStarActivity": {
      "description": "The GitHub repository of this package may have been artificially inflated with stars (from bots, crowdsourcing, etc.).",
      "title": "Suspicious Stars on GitHub",
      "suggestion": "This could be a sign of spam, fraud, or even a supply chain attack. The package should be carefully reviewed before installing.",
      "emoji": "⚠️"
    },
    "suspiciousString": {
      "description": "This package contains suspicious text patterns which are commonly associated with bad behavior.",
      "suggestion": "The package code should be reviewed before installing",
      "title": "Suspicious strings",
      "emoji": "⚠️"
    },
    "telemetry": {
      "description": "This package contains telemetry which tracks how it is used.",
      "title": "Telemetry",
      "suggestion": "Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.",
      "emoji": "📞"
    },
    "trivialPackage": {
      "description": "Packages less than 10 lines of code are easily copied into your own project and may not warrant the additional supply chain risk of an external dependency.",
      "suggestion": "Removing this package as a dependency and implementing its logic will reduce supply chain risk.",
      "title": "Trivial Package",
      "emoji": "⚠️"
    },
    "troll": {
      "description": "This package is a joke, parody, or includes undocumented or hidden behavior unrelated to its primary function.",
      "title": "Protestware or potentially unwanted behavior",
      "suggestion": "Consider that consuming this package may come along with functionality unrelated to its primary purpose.",
      "emoji": "🧌"
    },
    "typeModuleCompatibility": {
      "description": "Package is CommonJS, but has a dependency which is type: \"module\". The two are likely incompatible.",
      "suggestion": "The package needs to switch to dynamic import on the esmodule dependency, or convert to esm itself. Consumers may experience errors resulting from this incompatibility.",
      "title": "CommonJS depending on ESModule",
      "emoji": "⚠️"
    },
    "uncaughtOptionalDependency": {
      "description": "Package uses an optional dependency without handling a missing dependency exception. If you install it without the optional dependencies then it could cause runtime errors.",
      "suggestion": "Package should handle the loading of the dependency when it is not present, or convert the optional dependency into a regular dependency.",
      "title": "Uncaught optional dependency",
      "emoji": "⚠️"
    },
    "unclearLicense": {
      "description": "Package contains a reference to a license without a matching LICENSE file.",
      "suggestion": "Add a LICENSE file that matches the license field in package.json. https://docs.npmjs.com/cli/v8/configuring-npm/package-json#license",
      "title": "Unclear license",
      "emoji": "⚠️"
    },
    "unmaintained": {
      "description": "Package has not been updated in more than 5 years and may be unmaintained. Problems with the package may go unaddressed.",
      "suggestion": "Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance.",
      "title": "Unmaintained",
      "emoji": "⚠️"
    },
    "unpopularPackage": {
      "description": "This package is not very popular.",
      "suggestion": "Unpopular packages may have less maintenance and contain other problems.",
      "title": "Unpopular package",
      "emoji": "🏚️"
    },
    "unpublished": {
      "description": "Package version was not found on the registry. It may exist on a different registry and need to be configured to pull from that registry.",
      "suggestion": "Packages can be removed from the registry by manually un-publishing, a security issue removal, or may simply never have been published to the registry. Reliance on these packages will cause problem when they are not found.",
      "title": "Unpublished package",
      "emoji": "⚠️"
    },
    "unresolvedRequire": {
      "description": "Package imports a file which does not exist and may not work as is. It could also be importing a file that will be created at runtime which could be a vector for running malicious code.",
      "suggestion": "Fix imports so that they require declared dependencies or existing files.",
      "title": "Unresolved require",
      "emoji": "🕵️"
    },
    "unsafeCopyright": {
      "description": "(Experimental) Package contains a copyright but no license. Using this package may expose you to legal risk.",
      "suggestion": "Clarify the license type by adding a license field to package.json and a LICENSE file.",
      "title": "Unsafe copyright",
      "emoji": "⚠️"
    },
    "unstableOwnership": {
      "description": "A new collaborator has begun publishing package versions. Package stability and security risk may be elevated.",
      "suggestion": "Try to reduce the amount of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.",
      "title": "Unstable ownership",
      "emoji": "⚠️"
    },
    "unusedDependency": {
      "description": "Package has unused dependencies. This package depends on code that it does not use. This can increase the attack surface for malware and slow down installation.",
      "suggestion": "Packages should only specify dependencies that they use directly.",
      "title": "Unused dependency",
      "emoji": "⚠️"
    },
    "urlStrings": {
      "description": "Package contains fragments of external URLs or IP addresses, which may indicate that it covertly exfiltrates data.",
      "suggestion": "Avoid using packages that make connections to the network, since this helps to leak data.",
      "title": "URL strings",
      "emoji": "⚠️"
    },
    "usesEval": {
      "description": "Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.",
      "suggestion": "Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code.",
      "title": "Uses eval",
      "emoji": "⚠️"
    },
    "zeroWidth": {
      "description": "Package files contain zero width unicode characters. This could indicate a supply chain attack.",
      "suggestion": "Packages should remove unnecessary zero width unicode characters and use their visible counterparts.",
      "title": "Zero width unicode chars",
      "emoji": "⚠️"
    }
  }
}