Secure your dependencies. Ship with confidence.

While the execution of 'build.js' may be standard, the subsequent curl command raises concerns about potential data exfiltration or telemetry to an external server.

The provided source code establishes a reverse shell, which is a serious security threat. It allows remote execution of commands on the affected system, posing a high security risk.

Live on npm for 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code is highly suspicious and likely malicious due to its behavior of sending environment variables to an external server. This poses a significant security risk as it can lead to data theft.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The source code is designed to exfiltrate sensitive system information (hostname, username, current working directory, network interfaces) to an external server (pingb.in) without user consent. This is a clear case of malicious behavior.

Live on npm for 3 hours and 11 minutes before removal. Socket users were protected even while the package was live.

The code implements a WebSocket server that handles client connections, performs session management, and executes various operations based on client messages. However, it introduces several security risks, including the use of the 'Eval' module for executing arbitrary code, lack of input validation and sanitization, and the presence of hardcoded credentials and secrets. These issues can lead to code injection vulnerabilities, data leakage, and other security vulnerabilities. The code should be thoroughly reviewed and improved to ensure secure communication, proper input handling, and protection against potential attacks.

Live on npm for 38 days, 2 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in active-press (RubyGems)

The code makes external API requests using user-provided tokens without proper validation, which can lead to security vulnerabilities such as exposing sensitive tokens. Additionally, the presence of obfuscated code increases the likelihood of hidden malicious behavior. The code poses a security risk and should be reviewed and refactored to address these concerns.

Live on npm for 37 minutes before removal. Socket users were protected even while the package was live.

Malicious code in polkadot-staking-dashboard (npm) Source: ghsa-malware (c32ac6037f8efd8498b7430ec7d3450fcbb584dbf0f9e2761e9c12a0a0b8d255) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 52 minutes before removal. Socket users were protected even while the package was live.

The purpose of this code appears to be collecting specific environment variables and package information, compressing and encoding it, and sending it over HTTP to a remote domain. The intent and purpose of this behavior are unclear from the provided code fragment alone.

Live on npm for 32 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior by creating and executing arbitrary code from a temporary file after installation, posing a significant security risk. The behavior could lead to arbitrary code execution and unauthorized actions, justifying the high risk score. Additionally, the potential for obfuscation in attempting to hide the malicious behavior warrants a non-negligible obfuscated score.

This script is clearly malicious as it is exfiltrating sensitive information from the user's system to a remote server without consent. It poses a severe security risk.

Live on npm for 15 minutes before removal. Socket users were protected even while the package was live.

The code contains serious security threats, including a reverse shell and environment variable exfiltration. These actions are malicious and represent a high security risk.

Live on pypi for 1 hour and 14 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

The code exhibits several behaviors that are indicative of potential malicious activity, including obfuscation, execution of shell commands, and modification of shell configuration files. These actions pose a significant security risk and suggest a need for further investigation.

Live on npm for 9 days, 17 hours and 49 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information and project details to external servers without user consent. The presence of an infinite loop and the transmission of potentially sensitive data raise significant security concerns.

Live on npm for 2 hours and 13 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code has several unusual patterns, including strange module names, hardcoded strings, and non-standard method calls on imported modules. These anomalies suggest the potential for malicious behavior, although no direct evidence of data theft or system damage is present in the given fragment.

Live on npm for 56 days, 11 hours and 45 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

The code collects sensitive system information without user consent and sends it to an external server via a Discord webhook. The code gathers data such as the user's internal IP address, external IP address (obtained via an HTTP request to 'https[:]//ipinfo[.]io/json'), hostname, username, home directory, DNS server information, and package details from 'package.json'. This information is then formatted into a JSON object and transmitted to a hardcoded Discord webhook URL ('https[:]//discord[.]com/api/webhooks/...'). This behavior constitutes unauthorized data exfiltration and poses significant privacy and security risks.

This code poses a serious security risk and should not be used.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

Malicious code in auto-scaling_methods (RubyGems)

This script is highly suspicious as it appears to exfiltrate user information to an external server via DNS lookup. This behavior is indicative of malware.

The code snippet exfiltrates the current user's username to an external domain, which is a serious security concern. This action can be considered malicious as it involves sending potentially sensitive information without user consent.

Live on npm for 16 minutes before removal. Socket users were protected even while the package was live.

This script is performing potentially malicious actions by sending data from the '/etc/passwd' file to remote URLs. It is highly likely that this script is malicious and poses a significant security risk.

Live on npm for 5 hours and 7 minutes before removal. Socket users were protected even while the package was live.

While the execution of 'build.js' may be standard, the subsequent curl command raises concerns about potential data exfiltration or telemetry to an external server.

The provided source code establishes a reverse shell, which is a serious security threat. It allows remote execution of commands on the affected system, posing a high security risk.

Live on npm for 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code is highly suspicious and likely malicious due to its behavior of sending environment variables to an external server. This poses a significant security risk as it can lead to data theft.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The source code is designed to exfiltrate sensitive system information (hostname, username, current working directory, network interfaces) to an external server (pingb.in) without user consent. This is a clear case of malicious behavior.

Live on npm for 3 hours and 11 minutes before removal. Socket users were protected even while the package was live.

The code implements a WebSocket server that handles client connections, performs session management, and executes various operations based on client messages. However, it introduces several security risks, including the use of the 'Eval' module for executing arbitrary code, lack of input validation and sanitization, and the presence of hardcoded credentials and secrets. These issues can lead to code injection vulnerabilities, data leakage, and other security vulnerabilities. The code should be thoroughly reviewed and improved to ensure secure communication, proper input handling, and protection against potential attacks.

Live on npm for 38 days, 2 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in active-press (RubyGems)

The code makes external API requests using user-provided tokens without proper validation, which can lead to security vulnerabilities such as exposing sensitive tokens. Additionally, the presence of obfuscated code increases the likelihood of hidden malicious behavior. The code poses a security risk and should be reviewed and refactored to address these concerns.

Live on npm for 37 minutes before removal. Socket users were protected even while the package was live.

Malicious code in polkadot-staking-dashboard (npm) Source: ghsa-malware (c32ac6037f8efd8498b7430ec7d3450fcbb584dbf0f9e2761e9c12a0a0b8d255) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 52 minutes before removal. Socket users were protected even while the package was live.

The purpose of this code appears to be collecting specific environment variables and package information, compressing and encoding it, and sending it over HTTP to a remote domain. The intent and purpose of this behavior are unclear from the provided code fragment alone.

Live on npm for 32 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior by creating and executing arbitrary code from a temporary file after installation, posing a significant security risk. The behavior could lead to arbitrary code execution and unauthorized actions, justifying the high risk score. Additionally, the potential for obfuscation in attempting to hide the malicious behavior warrants a non-negligible obfuscated score.

This script is clearly malicious as it is exfiltrating sensitive information from the user's system to a remote server without consent. It poses a severe security risk.

Live on npm for 15 minutes before removal. Socket users were protected even while the package was live.

The code contains serious security threats, including a reverse shell and environment variable exfiltration. These actions are malicious and represent a high security risk.

Live on pypi for 1 hour and 14 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

The code exhibits several behaviors that are indicative of potential malicious activity, including obfuscation, execution of shell commands, and modification of shell configuration files. These actions pose a significant security risk and suggest a need for further investigation.

Live on npm for 9 days, 17 hours and 49 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information and project details to external servers without user consent. The presence of an infinite loop and the transmission of potentially sensitive data raise significant security concerns.

Live on npm for 2 hours and 13 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code has several unusual patterns, including strange module names, hardcoded strings, and non-standard method calls on imported modules. These anomalies suggest the potential for malicious behavior, although no direct evidence of data theft or system damage is present in the given fragment.

Live on npm for 56 days, 11 hours and 45 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

The code collects sensitive system information without user consent and sends it to an external server via a Discord webhook. The code gathers data such as the user's internal IP address, external IP address (obtained via an HTTP request to 'https[:]//ipinfo[.]io/json'), hostname, username, home directory, DNS server information, and package details from 'package.json'. This information is then formatted into a JSON object and transmitted to a hardcoded Discord webhook URL ('https[:]//discord[.]com/api/webhooks/...'). This behavior constitutes unauthorized data exfiltration and poses significant privacy and security risks.

This code poses a serious security risk and should not be used.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

Malicious code in auto-scaling_methods (RubyGems)

This script is highly suspicious as it appears to exfiltrate user information to an external server via DNS lookup. This behavior is indicative of malware.

The code snippet exfiltrates the current user's username to an external domain, which is a serious security concern. This action can be considered malicious as it involves sending potentially sensitive information without user consent.

Live on npm for 16 minutes before removal. Socket users were protected even while the package was live.

This script is performing potentially malicious actions by sending data from the '/etc/passwd' file to remote URLs. It is highly likely that this script is malicious and poses a significant security risk.

Live on npm for 5 hours and 7 minutes before removal. Socket users were protected even while the package was live.