feat: added nextjs integration example

[contawo]

Description

Adds a full-stack Next.js 16 project to the monorepo that demonstrates a production-closer integration pattern — live crypto market data via CoinGecko, currency and search filtering, and MoonPay buy/sell widgets with all sensitive API keys kept strictly server-side.

Changes

New project — moonpay-nextjs-buy-and-sell

Full Next.js 16 + React 19 application with App Router, server components, route handlers, Tailwind CSS v4, and the MoonPay React SDK. Includes a market table with coin logos, prices, last-updated timestamps, and buy/sell action buttons per row.

SSR + client-side filtering

Initial market data is fetched server-side at request time (default currency USD). Currency selection and coin search trigger a client-side refetch via /api/crypto, using useTransition for pending state without extra loading state boilerplate.

Server-side API key security

All sensitive keys (MoonPay secret, MoonPay API key, CoinGecko key) are server-only environment variables with no NEXT_PUBLIC_ prefix. The CoinGecko key is injected in the route handler. The MoonPay apiKey is stripped from the URL on the client, re-injected server-side, then signed — preventing key exposure in browser network requests.

Built-in MoonPay URL signing

HMAC-SHA256 signing is handled by a Next.js route handler at /api/sign-url — no separate Express signing server needed for this project.

Monorepo updates

Added moonpay-nextjs-buy-and-sell to npm workspaces. New start:nextjs script at the root. clean script updated to also remove .next and the project's node_modules. build script updated to include the new workspace.

Documentation

New project-level README.md and .env.example with annotated variables. Root README.md updated with the new project in the projects table, split env setup instructions, updated ports table, and expanded scripts reference.

Files changed

• package.json (modified)
• README.md (modified)
• moonpay-nextjs-buy-and-sell/
  • app/api/crypto/route.ts (new)
  • app/api/sign-url/route.ts (new)
  • context/MoonPay.tsx (new)
  • components/market/MarketClient.tsx (new)
  • config/keys.ts (new)
  • README.md (new)
  • .env.example (new)

How to test

cd moonpay-nextjs-buy-and-sell
cp .env.example .env.local
# fill in keys in .env.local
npm install && npm run dev

# or from root:
npm run start:nextjs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.2.3
	eslint-config-next@​16.2.3
	@​types/​react-dom@​19.2.3
	@​types/​react@​19.2.14
	react-icons@​5.6.0
	@​types/​node@​20.19.39
	tailwindcss@​4.2.2
	react@​19.2.4
	@​moonpay/​moonpay-react@​1.10.6
	eslint@​9.39.4
	typescript@​5.9.3
	react-dom@​19.2.4
	@​tailwindcss/​postcss@​4.2.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @img/sharp-libvips-darwin-arm64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-darwin-arm64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-darwin-arm64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-darwin-x64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-darwin-x64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-darwin-x64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-arm under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linux-arm@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-arm@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-arm64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linux-arm64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-arm64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-ppc64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linux-ppc64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-ppc64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-riscv64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linux-riscv64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-riscv64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-s390x under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linux-s390x@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-s390x@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linux-x64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linux-x64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linux-x64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linuxmusl-arm64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linuxmusl-arm64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-arm64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-libvips-linuxmusl-x64 under LGPL-3.0-or-later Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-libvips-linuxmusl-x64@1.2.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-libvips-linuxmusl-x64@1.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-wasm32 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-wasm32@0.34.5 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-wasm32@0.34.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-win32-arm64 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-win32-arm64@0.34.5 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-arm64@0.34.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-win32-ia32 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-win32-ia32@0.34.5 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-ia32@0.34.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @img/sharp-win32-x64 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/next@16.2.3 → npm/@img/sharp-win32-x64@0.34.5 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-win32-x64@0.34.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm axe-core under MIT AND MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/eslint-config-next@16.2.3 → npm/axe-core@4.11.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axe-core@4.11.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-android-arm64 under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-android-arm64@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-android-arm64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-darwin-arm64 under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-darwin-arm64@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-darwin-arm64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-darwin-x64 under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-darwin-x64@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-darwin-x64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-freebsd-x64 under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-freebsd-x64@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-freebsd-x64@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-linux-arm-gnueabihf under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-linux-arm-gnueabihf@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-arm-gnueabihf@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-linux-arm64-gnu under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-linux-arm64-gnu@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-arm64-gnu@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-linux-arm64-musl under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-linux-arm64-musl@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-arm64-musl@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-linux-x64-gnu under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-linux-x64-gnu@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-x64-gnu@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-linux-x64-musl under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-linux-x64-musl@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-linux-x64-musl@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-win32-arm64-msvc under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-win32-arm64-msvc@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-win32-arm64-msvc@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm lightningcss-win32-x64-msvc under MPL-2.0 Location: Package overview From: moonpay-nextjs-buy-and-sell/package-lock.json → npm/@tailwindcss/postcss@4.2.2 → npm/lightningcss-win32-x64-msvc@1.32.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lightningcss-win32-x64-msvc@1.32.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 3 more rows in the dashboard

View full report