Is socket.io-client-v2 safe?
Versions 6.0.2, 3.4.2 and 6.0.3 of socket.io-client-v2 were compromised; other versions are not flagged as malicious. CyberXYZ Proxy blocks the affected versions. It has no CVE advisories; the risk is the package's own code.
Do not install socket.io-client-v2 6.0.2, 3.4.2 or 6.0.3
CRITICALCompromised releases. Added to CyberXYZ 2024-06-25, OSV malicious-package feed (Google / OpenSSF).
The publishing source recorded this as malicious without a public write-up.
- Malicious
- 6.0.2, 3.4.2, 6.0.3
- Move to
- 2.5.0 current release, no known advisory
If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.
npm install socket.io-client-v2@2.5.0
0 packages depend on it
an advisory here reaches each of them
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
Is socket.io-client-v2 safe to install?
Versions 6.0.2, 3.4.2 and 6.0.3 of socket.io-client-v2 were compromised. Other versions are not flagged as malicious.
Does socket.io-client-v2 have known vulnerabilities?
No CVE advisories are recorded for socket.io-client-v2 (npm), but it has a malicious-package record: the risk is the package's own code, not a CVE.
Which version of socket.io-client-v2 should I use?
Use 2.5.0 or a later release that is not named as malicious. Versions named on this report as malicious must not be installed.
How do I check socket.io-client-v2 before installing?
Search socket.io-client-v2 in CyberXYZ Check at https://cyberxyz.io/check?q=socket.io-client-v2. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 10:27 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.