Secure your dependencies. Ship with confidence.

The code exhibits clear signs of malicious behavior involving data theft and exfiltration. It encodes and sends sensitive system and user data to a suspicious domain via both DNS queries and HTTPS POST requests.

Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.

The code is downloading data from https://members-hub.store/linkbyauth?pass=[PASSWORD]. It then uses the response to make another request to download more code. The downloaded code is stored in this._files. The load_FromPath method uses eval() to execute the downloaded code.

This code is intentionally obfuscated and uses DNS queries to exfiltrate system information, which could be a significant security risk. The hardcoded domain and the potential data exfiltration raise concerns about privacy violations. This package should be reviewed carefully before being used.

The code exhibits clear signs of malicious intent, as it collects sensitive information and sends it to an external server without user consent, which is a typical behavior of malware designed for data exfiltration. The hardcoded server domain and the lack of any legitimate purpose for this data collection further support the conclusion that this code is part of a supply chain attack.

Live on npm for 55 minutes before removal. Socket users were protected even while the package was live.

The code contains obfuscated portions that could potentially conceal a malicious payload. While the majority of the code seems to provide legitimate utility functions, the obfuscation and potential for hidden malicious code cannot be ignored. Careful deobfuscation and further analysis would be needed to conclusively determine the safety of the package.

The source code is performing malicious activities by collecting system information and sending it to a remote server via DNS queries. This behavior indicates data exfiltration and poses a significant security risk.

Live on npm for 3 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code is using telegram bot to run arbitary command using eval().

This file is encrypted with PyArmor

The code is potentially dangerous as it downloads and executes an arbitrary file without proper verification. It also suppresses SSL certificate verification, which is a security risk. The code lacks proper error handling as well.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 27 minutes before removal. Socket users were protected even while the package was live.

The code contains obfuscated portions that could potentially conceal a malicious payload. While the majority of the code seems to provide legitimate utility functions, the obfuscation and potential for hidden malicious code cannot be ignored. Careful deobfuscation and further analysis would be needed to conclusively determine the safety of the package.

The script collects a wide range of information from the user's system, including OS details, network interfaces, and SSH files, and sends it to a remote server via DNS queries.

The script is pinging three different domains which may indicate that the package is attempting to communicate with a remote server or perform some sort of network-related operation. The domains themselves appear to be suspicious and could potentially be associated with malicious activity. This is a high risk and should be investigated further.

Live on npm for 18 hours and 46 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by collecting environment variables and sending them to an obfuscated remote server. This poses a significant security risk as it may lead to data theft. The obfuscation of the host address further indicates potential malicious intent.

This file is encrypted with PyArmor

The script is potentially harmful as it collects detailed system information and executes an obfuscated script with eval(). This could lead to various types of attacks depending on the content of the obfuscated string. Therefore, using this script without understanding the decompressed content of the obfuscated string is risky and should be avoided.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The script shows clear signs of malicious intent or could be used in harmful ways, primarily through automated spamming or potential unauthorized content manipulation. The hard-coded credentials and the automated, hidden nature of operations (like file deletion and infinite loops) suggest a high security risk.

Live on npm for 1 hour and 25 minutes before removal. Socket users were protected even while the package was live.

This script performs potentially malicious actions by performing DNS lookup and downloading a file from a remote server. It is highly suspicious and poses a significant security risk.

Live on npm for 5 hours and 35 minutes before removal. Socket users were protected even while the package was live.

The script exhibits potentially malicious behavior, such as creating and publishing a large number of npm packages and posting links to WordPress sites. The hardcoded credentials and use of subprocess for npm publish are significant security risks. While the intent may be to automate content creation and posting, the scale and method raise concerns of abuse and potential harm.

Live on npm for 1 hour and 6 minutes before removal. Socket users were protected even while the package was live.

The code collects system information and sends it over HTTPS to a specific hostname. It also disables TLS certificate validation. The purpose and intentions behind collecting and sending this information are not clear from the provided code fragment.

Live on npm for 1 day, 4 hours and 45 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious due to its obfuscation and behavior of gathering system information and performing a DNS lookup on a constructed domain. This can be considered a form of data exfiltration and poses a security risk.

Live on npm for 1 day, 21 hours and 14 minutes before removal. Socket users were protected even while the package was live.

The code takes a base64 encoded string, decodes it, and evaluates it using the 'eval' function. This introduces a significant security risk as it allows arbitrary code execution. The code should be considered dangerous and should not be used.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

The script downloads an executable file (app.exe) from a remote server and then launches it. This behavior can introduce potential security risks if the downloaded file is malicious.

Live on npm for 6 days, 8 hours and 30 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior such as unauthorized login attempts and content publishing, as well as obfuscation and hard-coded credentials. The overall security risk is high due to the presence of these factors.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code exhibits clear signs of malicious behavior involving data theft and exfiltration. It encodes and sends sensitive system and user data to a suspicious domain via both DNS queries and HTTPS POST requests.

Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.

The code is downloading data from https://members-hub.store/linkbyauth?pass=[PASSWORD]. It then uses the response to make another request to download more code. The downloaded code is stored in this._files. The load_FromPath method uses eval() to execute the downloaded code.

This code is intentionally obfuscated and uses DNS queries to exfiltrate system information, which could be a significant security risk. The hardcoded domain and the potential data exfiltration raise concerns about privacy violations. This package should be reviewed carefully before being used.

The code exhibits clear signs of malicious intent, as it collects sensitive information and sends it to an external server without user consent, which is a typical behavior of malware designed for data exfiltration. The hardcoded server domain and the lack of any legitimate purpose for this data collection further support the conclusion that this code is part of a supply chain attack.

Live on npm for 55 minutes before removal. Socket users were protected even while the package was live.

The code contains obfuscated portions that could potentially conceal a malicious payload. While the majority of the code seems to provide legitimate utility functions, the obfuscation and potential for hidden malicious code cannot be ignored. Careful deobfuscation and further analysis would be needed to conclusively determine the safety of the package.

The source code is performing malicious activities by collecting system information and sending it to a remote server via DNS queries. This behavior indicates data exfiltration and poses a significant security risk.

Live on npm for 3 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code is using telegram bot to run arbitary command using eval().

This file is encrypted with PyArmor

The code is potentially dangerous as it downloads and executes an arbitrary file without proper verification. It also suppresses SSL certificate verification, which is a security risk. The code lacks proper error handling as well.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 27 minutes before removal. Socket users were protected even while the package was live.

The code contains obfuscated portions that could potentially conceal a malicious payload. While the majority of the code seems to provide legitimate utility functions, the obfuscation and potential for hidden malicious code cannot be ignored. Careful deobfuscation and further analysis would be needed to conclusively determine the safety of the package.

The script collects a wide range of information from the user's system, including OS details, network interfaces, and SSH files, and sends it to a remote server via DNS queries.

The script is pinging three different domains which may indicate that the package is attempting to communicate with a remote server or perform some sort of network-related operation. The domains themselves appear to be suspicious and could potentially be associated with malicious activity. This is a high risk and should be investigated further.

Live on npm for 18 hours and 46 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by collecting environment variables and sending them to an obfuscated remote server. This poses a significant security risk as it may lead to data theft. The obfuscation of the host address further indicates potential malicious intent.

This file is encrypted with PyArmor

The script is potentially harmful as it collects detailed system information and executes an obfuscated script with eval(). This could lead to various types of attacks depending on the content of the obfuscated string. Therefore, using this script without understanding the decompressed content of the obfuscated string is risky and should be avoided.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The script shows clear signs of malicious intent or could be used in harmful ways, primarily through automated spamming or potential unauthorized content manipulation. The hard-coded credentials and the automated, hidden nature of operations (like file deletion and infinite loops) suggest a high security risk.

Live on npm for 1 hour and 25 minutes before removal. Socket users were protected even while the package was live.

This script performs potentially malicious actions by performing DNS lookup and downloading a file from a remote server. It is highly suspicious and poses a significant security risk.

Live on npm for 5 hours and 35 minutes before removal. Socket users were protected even while the package was live.

The script exhibits potentially malicious behavior, such as creating and publishing a large number of npm packages and posting links to WordPress sites. The hardcoded credentials and use of subprocess for npm publish are significant security risks. While the intent may be to automate content creation and posting, the scale and method raise concerns of abuse and potential harm.

Live on npm for 1 hour and 6 minutes before removal. Socket users were protected even while the package was live.

The code collects system information and sends it over HTTPS to a specific hostname. It also disables TLS certificate validation. The purpose and intentions behind collecting and sending this information are not clear from the provided code fragment.

Live on npm for 1 day, 4 hours and 45 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious due to its obfuscation and behavior of gathering system information and performing a DNS lookup on a constructed domain. This can be considered a form of data exfiltration and poses a security risk.

Live on npm for 1 day, 21 hours and 14 minutes before removal. Socket users were protected even while the package was live.

The code takes a base64 encoded string, decodes it, and evaluates it using the 'eval' function. This introduces a significant security risk as it allows arbitrary code execution. The code should be considered dangerous and should not be used.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

The script downloads an executable file (app.exe) from a remote server and then launches it. This behavior can introduce potential security risks if the downloaded file is malicious.

Live on npm for 6 days, 8 hours and 30 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior such as unauthorized login attempts and content publishing, as well as obfuscation and hard-coded credentials. The overall security risk is high due to the presence of these factors.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.