Repository navigation
docs(npm): document Socket integrations - #11268
Conversation
📝 WalkthroughWalkthroughAdds npm backend documentation for Socket’s Bun-compatible security scanner and Socket Firewall integrations, including configuration, execution timing, credential handling, and proxy or CA settings. Changesnpm Socket security documentation
Estimated code review effort: 1 (Trivial) | ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryAdds npm backend documentation for integrating Socket through aube’s Bun-compatible scanner or Socket Firewall.
Confidence Score: 5/5The documentation-only change appears safe to merge. No blocking failure remains. Important Files Changed
Reviews (3): Last reviewed commit: "docs(npm): clarify Socket CA handling" | Re-trigger Greptile |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/dev-tools/backends/npm.md`:
- Around line 60-69: Update the scanner example to explicitly select the
embedded aube installer, such as by setting npm.package_manager=aube alongside
AUBE_SECURITY_SCANNER, so the documented install always uses scanner-enabled
aube rather than falling back to npm under the default auto setting.
- Around line 103-105: Update the documentation around the mise npm metadata
client and embedded aube installer to state that proxy settings are handled at
the firewall layer, but remove them from the claim that NODE_EXTRA_CA_CERTS
configures those components. Scope NODE_EXTRA_CA_CERTS to the Node-based Socket
scanner subprocess, and document npm.shell_out as the npm-specific option when
mise/aube TLS trust depends on npm configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 79c0f33e-bd09-4749-8052-7a3a3c5efaab
📒 Files selected for processing (1)
docs/dev-tools/backends/npm.md
| This works at the network layer. Mise's npm metadata client and embedded aube | ||
| installer honor the `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, and | ||
| `NODE_EXTRA_CA_CERTS` configuration injected by the firewall. Socket currently |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C4 'NODE_EXTRA_CA_CERTS|cafile|strict-ssl|HTTP_PROXY|HTTPS_PROXY|NO_PROXY' srcRepository: jdx/mise
Length of output: 742
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
fd -a 'npm.md|npm.rs|.*aube.*|aube' . | sed 's#^\./##' | head -200
echo
echo "== docs context =="
sed -n '80,125p' docs/dev-tools/backends/npm.md 2>/dev/null || true
echo
echo "== code search backend/npm and aube references =="
rg -n -C3 'NODE_EXTRA_CA_CERTS|cafile|TLS|TLS_CONFIG|reqwest|rustls|proxy|ca |certificate|aube|Aube|npm|npm view|HTTP_PROXY|HTTPS_PROXY|NO_PROXY' src docs -S | head -300
echo
echo "== npm.rs outline around proxy/config =="
ast-grep outline src/backend/npm.rs --match 'npm' --view expanded 2>/dev/null || trueRepository: jdx/mise
Length of output: 17662
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== npm metadata/client config usage =="
sed -n '1,140p' src/backend/npm.rs
sed -n '140,560p' src/backend/npm.rs | sed -n '1,120p'
rg -n -C5 'NODE_EXTRA_CA_CERTS|HTTP_PROXY|HTTPS_PROXY|NO_PROXY|cafile|npm_config_cafile|npm_config_ca|registry\.npmjs|metadata|npm_view|list_remote' src/backend/npm.rs src -S
echo
echo "== npm crate deps/package files that may define npm/lib npm view implementation =="
rg -n '"npm"|npm' Cargo.toml Cargo.lock -C5 | head -200
echo
echo "== aube provider docs and code =="
sed -n '1,220p' src/deps/providers/aube.rs
cat registry/aube.toml
rg -n -C4 'ca|tls|proxy|HTTP_PROXY|HTTPS_PROXY|NODE_EXTRA_CA_CERTS|registry|certificate|cafile|strict-ssl' src/deps/providers/aube.rs registry/aube.toml docs -S
echo
echo "== package files =="
fd -a '(Cargo\.lock|Cargo\.toml|package\.json|pnpm-lock\.yaml|npm-aube|aube)' . | sed 's#^\./##' | head -200Repository: jdx/mise
Length of output: 50365
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== npm_registry.rs =="
sed -n '1,180p' src/backend/npm_registry.rs
echo
echo "== aube provider env/client setup =="
sed -n '1,180p' src/deps/providers/aube.rs
echo
echo "== focused env var searches =="
for p in src/backend/npm.rs src/backend/npm_registry.rs src/deps/providers/aube.rs; do
echo "--- $p"
rg -n -C3 'NODE_EXTRA_CA_CERTS|HTTP_PROXY|HTTPS_PROXY|NO_PROXY|cafile|ca_url|ca-file|strict-ssl|set_ca|rustls|native-certs|proxy|reqwest|RegistryClient|Aube' "$p" || true
done
echo
echo "== docs aube registry references =="
rg -n -C3 'aube|NODE_EXTRA_CA_CERTS|cafile|strict-ssl|HTTP_PROXY|HTTPS_PROXY|NO_PROXY' registry docs -S || trueRepository: jdx/mise
Length of output: 29099
🌐 Web query:
nodejs NODE_EXTRA_CA_CERTS reads on startup documentation
💡 Result:
The environment variable NODE_EXTRA_CA_CERTS is read by Node.js only when the process is first launched [1][2]. Because it is processed during the initial startup sequence, changes made to process.env.NODE_EXTRA_CA_CERTS at runtime have no effect on the current process [1][2]. When set, this variable directs Node.js to extend the well-known "root" Certificate Authorities (CAs) with additional certificates provided in the specified file [1][2]. The target file must contain one or more trusted certificates in PEM format [1][2]. Important behavioral notes from official documentation include: - Warnings: If the specified file is missing or malformed, Node.js will emit a warning exactly once using process.emitWarning, but will otherwise ignore any errors [1][2]. - Scope: The extra certificates are not used if the ca options property is explicitly specified for a TLS or HTTPS client or server [1][2]. - Security Restrictions: This environment variable is ignored if the Node.js process is running as setuid root or has Linux file capabilities set [1][2]. - Initialization: Because the variable is read at startup, setting it within a Node.js --env-file will not work, as the environment variable is read before the --env-file is parsed and loaded [3].
Citations:
- 1: https://nodejs.org/docs/latest-v19.x/api/cli.html
- 2: https://r2.nodejs.org/docs/v18.11.0/api/cli.html
- 3: NODE_EXTRA_CA_CERTS does not work when set in env file nodejs/node#51426
Scope NODE_EXTRA_CA_CERTS to the Socket scanner only.
NODE_EXTRA_CA_CERTS is consumed by Node when it starts, so it does not configure mise’s Rust npm registry client or embedded aube. Mention proxy handling at the firewall layer, then limit this variable to the Node subprocess such as the Socket scanner; for mise/aube, document the npm-only option (npm.shell_out) if TLS CA trust depends on npm-specific config.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/dev-tools/backends/npm.md` around lines 103 - 105, Update the
documentation around the mise npm metadata client and embedded aube installer to
state that proxy settings are handled at the firewall layer, but remove them
from the claim that NODE_EXTRA_CA_CERTS configures those components. Scope
NODE_EXTRA_CA_CERTS to the Node-based Socket scanner subprocess, and document
npm.shell_out as the npm-specific option when mise/aube TLS trust depends on npm
configuration.
Hyperfine Performance
|
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.12 x -- echo |
20.3 ± 2.6 | 18.0 | 34.7 | 1.00 |
mise x -- echo |
21.5 ± 1.5 | 19.6 | 29.2 | 1.06 ± 0.15 |
mise env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.12 env |
18.7 ± 0.8 | 17.2 | 22.0 | 1.00 |
mise env |
20.9 ± 1.9 | 18.5 | 47.2 | 1.11 ± 0.11 |
env measured 11% slower, but hyperfine reported statistical outliers. |
mise hook-env
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.12 hook-env |
25.7 ± 10.9 | 17.8 | 77.0 | 1.20 ± 0.51 |
mise hook-env |
21.5 ± 1.0 | 19.1 | 25.9 | 1.00 |
✅ Performance improvement for hook-env is 20% |
mise ls
| Command | Mean [ms] | Min [ms] | Max [ms] | Relative |
|---|---|---|---|---|
mise-2026.7.12 ls |
16.7 ± 0.7 | 15.4 | 20.5 | 1.00 |
mise ls |
18.5 ± 1.0 | 16.8 | 23.1 | 1.11 ± 0.08 |
ls measured 11% slower, but the relative uncertainty overlaps the 10% threshold. |
xtasks/test/perf
| Command | mise-2026.7.12 | mise | Variance |
|---|---|---|---|
| install (cached) | 161ms | 176ms | -8% |
| ls (cached) | 63ms | 64ms | -1% |
| bin-paths (cached) | 65ms | 67ms | -2% |
| task-ls (cached) | 133ms | 137ms | -2% |
Summary
Validation
mise run docs:buildmise run lint-fixmise run lintNote
Low Risk
Documentation-only change to the npm backend guide; no runtime or install behavior changes.
Overview
Adds a Socket security section to the npm backend docs, covering two integration paths for
npm:tools installed via mise.The Bun-compatible security scanner path documents enabling Socket through embedded aube via
AUBE_SECURITY_SCANNER(withMISE_NPM_PACKAGE_MANAGER=aube), when the scan runs, fail-closed behavior, the synthetic-project module-resolution caveat and absolutescanner.mjswrapper pattern, Node.js 22.6+, and relevant env vars.The Socket Firewall path documents wrapping
misewithsfw, notes proxy/CA behavior through aube-registry, and states that Socket’s upstream docs target npm/yarn/pnpm—not mise/aube—so interoperability is not guaranteed.Reviewed by Cursor Bugbot for commit 728765a. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
npm:tools installed via mise, including a Bun-compatible security scanner workflow that blocks installs on fatal findings.HTTP_PROXY,HTTPS_PROXY,NO_PROXY,NODE_EXTRA_CA_CERTS).