Package

textlint-rule-rfc2606-domains

Alert

URL strings (SUPPLY CHAIN RISK)

Socket flags example.com, example.net, example.org as external URLs that the package "may be accessing at runtime."

Why this is a false positive

This package is a textlint rule that detects placeholder domains in documentation and suggests RFC 2606 reserved domains. The flagged strings are string constants used purely for comparison — the package never makes any network requests.

// These are comparison constants, not URLs accessed at runtime
const RESERVED_DOMAINS = new Set(["example.com", "example.net", "example.org"]);

The entire source is a single file with zero runtime dependencies and no fetch, http, https, or any network imports: https://github.com/h13/textlint-rule-rfc2606-domains/blob/main/src/index.ts

Request

Please consider either:

1. Marking this as a false positive for this package
2. Excluding RFC 2606 reserved domains (example.com, example.net, example.org) from the URL strings heuristic, since they are explicitly reserved for documentation use and cannot pose a supply chain risk