Secure your dependencies. Ship with confidence.

This script is making a request to an external URL which could potentially be used for data exfiltration or to download malicious payloads. It poses a security risk and should be investigated further.

Live on npm for 31 minutes before removal. Socket users were protected even while the package was live.

The script is executing a file named 'malware.js', which raises concerns about potential malicious behavior. It is highly recommended to inspect the contents of 'malware.js' before running it.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code contains functionality for configuration management, database operations, and email sending. There are some security risks due to hardcoded MySQL credentials and a large base64 encoded string that could be a red flag for obfuscation. Database operations need careful handling to avoid SQL injection. Overall, the presence of hardcoded credentials and potential for hidden malicious behavior (base64 string) warrants further review.

Live on PyPI for 39 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by sending userId data to a hardcoded external IP address over unencrypted HTTP without authentication or user consent. This pattern is indicative of potential data exfiltration or privacy violation, which aligns with malware-like behavior. While the code itself is not obfuscated and does not contain explicit backdoors or credential leaks, the hardcoded external endpoint and silent error handling increase the security risk. Overall, this code should be treated as high risk and potentially malicious.

The code fetches JavaScript code from a specified URL and evaluates it using the 'eval' function. This can be potentially dangerous as it allows for arbitrary code execution, including code injection and remote code execution.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code contains a critical security risk due to the use of eval on dynamically decoded content. This pattern is often used to obfuscate malicious code, and without knowing the content of the decoded string, it poses a significant threat. The rest of the code appears to be legitimate functionality for color manipulation.

Live on npm for 15 minutes before removal. Socket users were protected even while the package was live.

This code is malicious. It performs unauthorized data exfiltration of system network interface IP addresses and hostname to an attacker-controlled Discord webhook. This behavior constitutes malware and poses a high security risk. The code is clear and not obfuscated, but the embedded webhook and silent transmission of system information without user consent make it dangerous and privacy-invasive.

The code contains a hidden data exfiltration mechanism in the exception handler that processes sensitive file paths and error information, then returns it disguised as a legitimate authentication token. While the main functionality appears legitimate, this represents a significant security threat through information disclosure.

The package contains a hidden payload that targets Russian language users visiting Russian and Belarusian sites. For those users, it will disable user interaction and play a looping audio of the Ukrainian anthem after 3 days. Therefore, it is marked as malware only because it freezes interactions for many users. This behavior is not disclosed in any documentation of the package and seriously disrupts user experience.

The code is heavily obfuscated and exhibits behaviors that are commonly associated with malicious intent, such as dynamic code execution and tampering with global object methods. The obfuscation and dynamic code execution present significant security risks. However, without additional context or the ability to deobfuscate the code, we cannot definitively confirm the presence of malware.

Live on npm for 3 days, 12 hours and 42 minutes before removal. Socket users were protected even while the package was live.

The code is performing unauthorized data exfiltration by sending system information and the contents of 'package.json' files to external servers. This behavior is indicative of malicious intent.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The most significant security risk identified is the `cm.eval` function, which allows the execution of arbitrary code parsed from a string. This, combined with the file system interaction functions (`cm.rf`, `cm.wf`) that can operate on user-controlled paths, presents a high security risk. The code is not intentionally obfuscated, but its complexity and the presence of an `eval`-like feature warrant careful scrutiny.

The provided source code exhibits several characteristics that are commonly associated with malware, such as the use of encryption, dynamic payload execution, and hardcoded sensitive values. While the exact purpose of the script is unclear without further analysis, the overall behavior and structure of the code suggest a high probability of malicious intent. This script should be treated with caution and further investigated before being used or executed.

Live on PyPI for 1 hour and 44 minutes before removal. Socket users were protected even while the package was live.

This file gathers and hexadecimal-encodes environment variables, hostname info, and file paths, then transmits them via DNS requests to old[.]6pi[.]net, indicating unauthorized exfiltration of system data. This behavior demonstrates malicious intent consistent with malware.

Live on npm for 18 days, 12 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious and likely malicious. It conditionally downloads and executes a cryptocurrency mining script unless the IP is from specific countries. The behavior includes downloading from a hardcoded IP, executing downloaded script, and mining cryptocurrency without user consent.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 56 minutes before removal. Socket users were protected even while the package was live.

This shell script collects the system’s hostname and username, then silently sends them to 18[.]157[.]124[.]229 using curl while bypassing SSL certificate checks and hiding output. These actions indicate malicious data exfiltration.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

Live on npm for 5 days, 8 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk due to downloading and executing an external script without verifying its integrity. This could lead to system compromise if the script is malicious.

The code is part of a legitimate penetration testing framework but has potential for misuse if implants are configured for malicious purposes. The framework itself is not malicious, but the generated outputs can be.

The code is clearly malicious, as it exfiltrates sensitive system and project information to external servers without user consent. It connects to suspicious domains and performs actions indicative of data theft.

Live on npm for 1 hour and 7 minutes before removal. Socket users were protected even while the package was live.

The code appears to be collecting sensitive system and user information and sending it to an external server, which is a common behavior in malware used for system reconnaissance and data exfiltration. The domain it connects to is also suspicious, as it seems to be generated for potentially malicious purposes.

Live on npm for 1 day, 10 hours and 26 minutes before removal. Socket users were protected even while the package was live.

Heavily obfuscated code using systematic character substitution cipher. Cannot determine actual functionality, data flows, or security implications without deobfuscation. The comprehensive nature of the obfuscation suggests intentional concealment of code behavior, which is highly suspicious in a software dependency.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 14 minutes before removal. Socket users were protected even while the package was live.

The provided source code exhibits clear malicious behavior by exfiltrating sensitive system information to a suspicious external domain. This poses a significant security risk.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.

This script is making a request to an external URL which could potentially be used for data exfiltration or to download malicious payloads. It poses a security risk and should be investigated further.

Live on npm for 31 minutes before removal. Socket users were protected even while the package was live.

The script is executing a file named 'malware.js', which raises concerns about potential malicious behavior. It is highly recommended to inspect the contents of 'malware.js' before running it.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code contains functionality for configuration management, database operations, and email sending. There are some security risks due to hardcoded MySQL credentials and a large base64 encoded string that could be a red flag for obfuscation. Database operations need careful handling to avoid SQL injection. Overall, the presence of hardcoded credentials and potential for hidden malicious behavior (base64 string) warrants further review.

Live on PyPI for 39 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by sending userId data to a hardcoded external IP address over unencrypted HTTP without authentication or user consent. This pattern is indicative of potential data exfiltration or privacy violation, which aligns with malware-like behavior. While the code itself is not obfuscated and does not contain explicit backdoors or credential leaks, the hardcoded external endpoint and silent error handling increase the security risk. Overall, this code should be treated as high risk and potentially malicious.

The code fetches JavaScript code from a specified URL and evaluates it using the 'eval' function. This can be potentially dangerous as it allows for arbitrary code execution, including code injection and remote code execution.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code contains a critical security risk due to the use of eval on dynamically decoded content. This pattern is often used to obfuscate malicious code, and without knowing the content of the decoded string, it poses a significant threat. The rest of the code appears to be legitimate functionality for color manipulation.

Live on npm for 15 minutes before removal. Socket users were protected even while the package was live.

This code is malicious. It performs unauthorized data exfiltration of system network interface IP addresses and hostname to an attacker-controlled Discord webhook. This behavior constitutes malware and poses a high security risk. The code is clear and not obfuscated, but the embedded webhook and silent transmission of system information without user consent make it dangerous and privacy-invasive.

The code contains a hidden data exfiltration mechanism in the exception handler that processes sensitive file paths and error information, then returns it disguised as a legitimate authentication token. While the main functionality appears legitimate, this represents a significant security threat through information disclosure.

The package contains a hidden payload that targets Russian language users visiting Russian and Belarusian sites. For those users, it will disable user interaction and play a looping audio of the Ukrainian anthem after 3 days. Therefore, it is marked as malware only because it freezes interactions for many users. This behavior is not disclosed in any documentation of the package and seriously disrupts user experience.

The code is heavily obfuscated and exhibits behaviors that are commonly associated with malicious intent, such as dynamic code execution and tampering with global object methods. The obfuscation and dynamic code execution present significant security risks. However, without additional context or the ability to deobfuscate the code, we cannot definitively confirm the presence of malware.

Live on npm for 3 days, 12 hours and 42 minutes before removal. Socket users were protected even while the package was live.

The code is performing unauthorized data exfiltration by sending system information and the contents of 'package.json' files to external servers. This behavior is indicative of malicious intent.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The most significant security risk identified is the `cm.eval` function, which allows the execution of arbitrary code parsed from a string. This, combined with the file system interaction functions (`cm.rf`, `cm.wf`) that can operate on user-controlled paths, presents a high security risk. The code is not intentionally obfuscated, but its complexity and the presence of an `eval`-like feature warrant careful scrutiny.

The provided source code exhibits several characteristics that are commonly associated with malware, such as the use of encryption, dynamic payload execution, and hardcoded sensitive values. While the exact purpose of the script is unclear without further analysis, the overall behavior and structure of the code suggest a high probability of malicious intent. This script should be treated with caution and further investigated before being used or executed.

Live on PyPI for 1 hour and 44 minutes before removal. Socket users were protected even while the package was live.

This file gathers and hexadecimal-encodes environment variables, hostname info, and file paths, then transmits them via DNS requests to old[.]6pi[.]net, indicating unauthorized exfiltration of system data. This behavior demonstrates malicious intent consistent with malware.

Live on npm for 18 days, 12 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious and likely malicious. It conditionally downloads and executes a cryptocurrency mining script unless the IP is from specific countries. The behavior includes downloading from a hardcoded IP, executing downloaded script, and mining cryptocurrency without user consent.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 56 minutes before removal. Socket users were protected even while the package was live.

This shell script collects the system’s hostname and username, then silently sends them to 18[.]157[.]124[.]229 using curl while bypassing SSL certificate checks and hiding output. These actions indicate malicious data exfiltration.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

Live on npm for 5 days, 8 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk due to downloading and executing an external script without verifying its integrity. This could lead to system compromise if the script is malicious.

The code is part of a legitimate penetration testing framework but has potential for misuse if implants are configured for malicious purposes. The framework itself is not malicious, but the generated outputs can be.

The code is clearly malicious, as it exfiltrates sensitive system and project information to external servers without user consent. It connects to suspicious domains and performs actions indicative of data theft.

Live on npm for 1 hour and 7 minutes before removal. Socket users were protected even while the package was live.

The code appears to be collecting sensitive system and user information and sending it to an external server, which is a common behavior in malware used for system reconnaissance and data exfiltration. The domain it connects to is also suspicious, as it seems to be generated for potentially malicious purposes.

Live on npm for 1 day, 10 hours and 26 minutes before removal. Socket users were protected even while the package was live.

Heavily obfuscated code using systematic character substitution cipher. Cannot determine actual functionality, data flows, or security implications without deobfuscation. The comprehensive nature of the obfuscation suggests intentional concealment of code behavior, which is highly suspicious in a software dependency.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 14 minutes before removal. Socket users were protected even while the package was live.

The provided source code exhibits clear malicious behavior by exfiltrating sensitive system information to a suspicious external domain. This poses a significant security risk.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.