NPM package dependencies, supply chain security analysis (Socket)

[danielweck]

FYI, no immediate action needed.

https://socket.dev/dashboard/org/gh/edrlab/repo/thorium-reader

• https://socket.dev/npm/package/chainsaw
• https://socket.dev/npm/package/buffers
• https://socket.dev/npm/package/traverse

svg-sprite-loader -> svg-baker -> traverse

r2-utils-js -> unzipper -> buffers
r2-utils-js -> unzipper -> chainsaw -> traverse

npm ls --all

[danielweck]

Too many "medium" alerts to list here (178, some direct, most transitive), all marked as "supply chain risk" by Socket (system shell, network access, eval, and a few other criteria match)

[danielweck]

Latest NPM package updates on the develop branch:
9f1e20a
=>
https://socket.dev/dashboard/org/gh/edrlab/sbom/180277f9-9f73-4588-afde-fcabb88ca3ac