URLs: https://developer.mozilla.org/docs/Web/API/Event/type, https://developer.mozilla.org/docs/Web/API/Event/eventPhase, https://developer.mozilla.org/docs/Web/API/Event/composed, https://developer.mozilla.org/docs/Web/API/Event/bubbles, https://developer.mozilla.org/docs/Web/API/Event/cancelable, https://developer.mozilla.org/docs/Web/API/Event/defaultPrevented, https://developer.mozilla.org/docs/Web/API/Event/returnValue, https://developer.mozilla.org/docs/Web/API/Event/currentTarget, https://developer.mozilla.org/docs/Web/API/Event/target, https://developer.mozilla.org/docs/Web/API/Event/srcElement, https://developer.mozilla.org/docs/Web/API/Event/timeStamp, https://developer.mozilla.org/docs/Web/API/Event/isTrusted, https://developer.mozilla.org/docs/Web/API/Event/cancelBubble, https://developer.mozilla.org/docs/Web/API/Event/stopImmediatePropagation, https://developer.mozilla.org/docs/Web/API/Event/preventDefault, https://developer.mozilla.org/docs/Web/API/Event/stopPropagation, https://developer.mozilla.org/docs/Web/API/AbortSignal/throwIfAborted, https://developer.mozilla.org/docs/Web/API/ExtendableEvent, https://developer.mozilla.org/docs/Web/API/ExtendableEvent/waitUntil, https://developer.mozilla.org/docs/Web/API/CustomEvent, https://developer.mozilla.org/docs/Web/API/CustomEvent/detail, https://developer.mozilla.org/docs/Web/API/Blob, https://developer.mozilla.org/docs/Web/API/Blob/size, https://developer.mozilla.org/docs/Web/API/Blob/type, https://developer.mozilla.org/docs/Web/API/PromiseRejectionEvent/promise, https://developer.mozilla.org/docs/Web/API/PromiseRejectionEvent/reason, https://developer.mozilla.org/docs/Web/API/FormData, https://developer.mozilla.org/docs/Web/API/FormData/append, https://developer.mozilla.org/docs/Web/API/FormData/delete, https://developer.mozilla.org/docs/Web/API/FormData/get, https://developer.mozilla.org/docs/Web/API/FormData/getAll, https://developer.mozilla.org/docs/Web/API/FormData/has, https://developer.mozilla.org/docs/Web/API/FormData/set, https://developer.mozilla.org/docs/Web/API/FetchEvent, https://developer.mozilla.org/docs/Web/API/FetchEvent/request, https://developer.mozilla.org/docs/Web/API/FetchEvent/respondWith, https://developer.mozilla.org/docs/Web/API/Headers, https://developer.mozilla.org/docs/Web/API/Headers/get, https://developer.mozilla.org/docs/Web/API/Headers/has, https://developer.mozilla.org/docs/Web/API/Headers/set, https://developer.mozilla.org/docs/Web/API/Headers/append, https://developer.mozilla.org/docs/Web/API/Headers/delete, https://developer.mozilla.org/docs/Web/API/Request/body, https://developer.mozilla.org/docs/Web/API/Request/bodyUsed, https://developer.mozilla.org/docs/Web/API/Request/arrayBuffer, https://developer.mozilla.org/docs/Web/API/Request/bytes, https://developer.mozilla.org/docs/Web/API/Request/text, https://developer.mozilla.org/docs/Web/API/Request/json, https://developer.mozilla.org/docs/Web/API/Request/formData, https://developer.mozilla.org/docs/Web/API/Request/blob, https://developer.mozilla.org/docs/Web/API/Response, https://developer.mozilla.org/docs/Web/API/Response/clone, https://developer.mozilla.org/docs/Web/API/Response/status, https://developer.mozilla.org/docs/Web/API/Response/statusText, https://developer.mozilla.org/docs/Web/API/Response/headers, https://developer.mozilla.org/docs/Web/API/Response/ok, https://developer.mozilla.org/docs/Web/API/Response/redirected, https://developer.mozilla.org/docs/Web/API/Response/url, https://developer.mozilla.org/docs/Web/API/Response/type, https://developer.mozilla.org/docs/Web/API/Request, https://developer.mozilla.org/docs/Web/API/Request/clone, https://developer.mozilla.org/docs/Web/API/Request/method, https://developer.mozilla.org/docs/Web/API/Request/url, https://developer.mozilla.org/docs/Web/API/Request/headers, https://developer.mozilla.org/docs/Web/API/Request/redirect, https://developer.mozilla.org/docs/Web/API/Request/signal, https://developer.mozilla.org/docs/Web/API/Request/integrity, https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultReader/read, https://developer.mozilla.org/docs/Web/API/ReadableStreamBYOBReader/releaseLock, https://developer.mozilla.org/docs/Web/API/ReadableStreamDefaultController, https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController/desiredSize, https://developer.mozilla.org/docs/Web/API/ReadableByteStreamController/close, https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultController, https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultController/signal, https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultController/error, https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController, https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/desiredSize, https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/enqueue, https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/error, https://developer.mozilla.org/docs/Web/API/TransformStreamDefaultController/terminate, https://developer.mozilla.org/docs/Web/API/WritableStream, https://developer.mozilla.org/docs/Web/API/WritableStream/locked, https://developer.mozilla.org/docs/Web/API/WritableStream/abort, https://developer.mozilla.org/docs/Web/API/WritableStream/close, https://developer.mozilla.org/docs/Web/API/WritableStream/getWriter, https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter, https://developer.mozilla.org/docs/Web/API/WritableStreamDefaultWriter/ready, https://developer.mozilla.org/docs/Web/API/URL/revokeObjectURL_static, https://developer.mozilla.org/docs/Web/API/URLSearchParams, https://developer.mozilla.org/docs/Web/API/URLSearchParams/size, https://developer.mozilla.org/docs/Web/API/URLSearchParams/append, https://developer.mozilla.org/docs/Web/API/URLSearchParams/delete, https://developer.mozilla.org/docs/Web/API/URLSearchParams/get, https://developer.mozilla.org/docs/Web/API/URLSearchParams/getAll, https://developer.mozilla.org/docs/Web/API/URLSearchParams/has, https://developer.mozilla.org/docs/Web/API/URLSearchParams/set, https://developer.mozilla.org/docs/Web/API/URLSearchParams/sort, https://developer.mozilla.org/docs/Web/API/CloseEvent, https://developer.mozilla.org/docs/Web/API/CloseEvent/code, https://developer.mozilla.org/docs/Web/API/CloseEvent/reason, https://developer.mozilla.org/docs/Web/API/CloseEvent/wasClean, https://developer.mozilla.org/docs/Web/API/WebSocket, https://developer.mozilla.org/docs/Web/API/WebSocket/send, https://developer.mozilla.org/docs/Web/API/WebSocket/close, https://developer.mozilla.org/docs/Web/API/WebSocket/readyState, https://developer.mozilla.org/docs/Web/API/WebSocket/url, https://developer.mozilla.org/docs/Web/API/WebSocket/protocol, https://developer.mozilla.org/docs/Web/API/WebSocket/extensions, https://developer.mozilla.org/docs/Web/API/WebSocket/binaryType, https://developers.cloudflare.com, https://github.com/openai/openai-node/blob/master/src/resources/responses/responses.ts, response.function_call_arguments.delta, response.reasoning_text.delta, response.refusal.delta, response.output_text.delta, https://dpgr.am/deepgram-mip., https://www.iana.org/assignments/as-numbers/as-numbers.xhtml, https://en.wikipedia.org/wiki/IATA_airport_code, https://developers.cloudflare.com/bots/concepts/bot-score/, https://developers.cloudflare.com/firewall/known-issues-and-faq/#how-does-firewall-rules-handle-traffic-from-known-bots, https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.2, https://www.rfc-editor.org/rfc/rfc5246#section-7.4.9, https://knowledge.digicert.com/generalinformation/INFO1745.html, https://www.rfc-editor.org/rfc/rfc2253.html, https://developer.mozilla.org/en-US/docs/Web/API/Headers, https://opensource.org/licenses/Apache-2.0, https://developers.cloudflare.com/pub-sub/, mqtts://BROKER.NAMESPACE.cloudflarepubsub.com:PORT, https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901063, https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/, https://developer.mozilla.org/docs/Web/API/Headers/getSetCookie, https://developer.mozilla.org/docs/Web/API/Performance/clearMarks, https://developer.mozilla.org/docs/Web/API/Performance/clearResourceTimings, https://developer.mozilla.org/docs/Web/API/Performance/getEntries, https://developer.mozilla.org/docs/Web/API/Performance/getEntriesByName, https://developer.mozilla.org/docs/Web/API/Performance/getEntriesByType, https://developer.mozilla.org/docs/Web/API/Performance/measure, https://developer.mozilla.org/docs/Web/API/PerformanceEntry, https://developer.mozilla.org/docs/Web/API/PerformanceEntry/name, https://developer.mozilla.org/docs/Web/API/PerformanceEntry/entryType, https://developer.mozilla.org/docs/Web/API/PerformanceEntry/startTime, https://developer.mozilla.org/docs/Web/API/PerformanceEntry/duration, https://developer.mozilla.org/docs/Web/API/PerformanceEntry/toJSON, https://developer.mozilla.org/docs/Web/API/PerformanceObserver, https://developer.mozilla.org/docs/Web/API/PerformanceObserver/disconnect, https://developer.mozilla.org/docs/Web/API/PerformanceObserver/observe, https://developer.mozilla.org/docs/Web/API/PerformanceObserver/takeRecords, https://dpgr.am/deepgram-mip, https://developers.cloudflare.com/workers-ai/features/batch-api, https://developers.cloudflare.com/ai-search/usage/workers-binding/, https://tldp.org/HOWTO/TCP-Keepalive-HOWTO/overview.html, https://developers.cloudflare.com/bots/reference/static-resources/, https://developers.cloudflare.com/bots/concepts/ja3-fingerprint/, https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/, https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/custom-metadata/, https://ldapwiki.com/wiki/Certificate%20Serial%20Number, https://www.iso.org/iso-3166-country-codes.html, https://support.cloudflare.com/hc/en-us/articles/203306930-Understanding-Cloudflare-Tor-support-and-Onion-Routing, https://developer.mozilla.org/docs/Web/API/EventSource, https://developer.mozilla.org/docs/Web/API/EventSource/close, https://developer.mozilla.org/docs/Web/API/EventSource/url, https://developer.mozilla.org/docs/Web/API/EventSource/withCredentials, https://developer.mozilla.org/docs/Web/API/EventSource/readyState, https://developer.mozilla.org/docs/Web/API/EventSource/open_event, https://developer.mozilla.org/docs/Web/API/EventSource/message_event, https://developer.mozilla.org/docs/Web/API/EventSource/error_event, https://developer.mozilla.org/docs/Web/API/MessagePort, https://developer.mozilla.org/docs/Web/API/MessagePort/postMessage, https://developer.mozilla.org/docs/Web/API/MessagePort/close, https://developer.mozilla.org/docs/Web/API/MessagePort/start, https://developers.cloudflare.com/workers/runtime-apis/performance/, https://developers.cloudflare.com/workers/runtime-apis/performance/#performancetimeorigin, https://developers.cloudflare.com/workers/runtime-apis/performance/#performancenow, https://developer.mozilla.org/docs/Web/API/Performance/toJSON

Location: Package overview

From: package.json → npm/@cloudflare/workers-types@4.20260415.1

ℹ Read more on: This package | This alert | What are URL strings?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/workers-types@4.20260415.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.