New Case Study:See how Anthropic automated 95% of dependency reviews with Socket.Learn More
Socket
Sign inDemoInstall
Socket

Secure your dependencies. Ship with confidence.

Socket is a developer-first security platform that protects your code from both vulnerable and malicious dependencies.

Install GitHub AppBook a Demo

Find and compare millions of open source packages

Quickly evaluate the security and health of any open source package.

jquery


timmywil published 3.7.1

left-pad


stevemao published 1.3.0

react


react-bot published 19.0.0

We protect you from vulnerable and malicious packages

test262-runner

0.1.14

by mkj47

Removed from npm

Blocked by Socket

The script appears to be designed to exfiltrate sensitive data from the /etc/hosts file to a remote server, which is indicative of malicious behavior. The use of ngrok.io suggests an attempt to bypass network restrictions and hide the true destination of the data.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.

quickcolor

1.0.1

by iloveduging!21r

Removed from npm

Blocked by Socket

The code contains a significant security risk by sending a potentially sensitive environment variable (`WALLET_PRIVATE_KEY`) to a Discord webhook without user consent. This behavior aligns with data exfiltration and poses a high security risk.

Live on npm for 20 days, 1 hour and 15 minutes before removal. Socket users were protected even while the package was live.

azure-graphrbac

0.1.0

Removed from npm

Blocked by Socket

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.

@7tv/playback-signature

3.647.2

by hjoyn

Live on npm

Blocked by Socket

The code exhibits potentially malicious behavior by filtering and sending environment variables to a suspicious domain, posing a risk of data leakage and unauthorized access. The use of string concatenation for domain construction and the encoding of data before sending it also raise concerns about obfuscation and malicious intent. The risk score of 0.82 is justified due to the potential risk of data leakage and unauthorized access posed by the code's behavior. The malware score of 0.82 is justified as the code exhibits behavior that could lead to data theft and unauthorized information disclosure.

enthereumjsu-til

1.2.0

by 17b4a931

Removed from npm

Blocked by Socket

This code poses a serious security risk and should not be used.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

amber-blocks

10.0.0

by bughunter.volgactf

Removed from npm

Blocked by Socket

The script is intentionally obfuscating its activities and sending potentially sensitive data from the environment variables over the network, which could be used maliciously. The URL and purpose of the data collection are unclear and potentially harmful.

Live on npm for 1 hour and 58 minutes before removal. Socket users were protected even while the package was live.

nldeuuid

1.2.0

by 17b4a931

Removed from npm

Blocked by Socket

This code poses a serious security risk and should not be used.

Live on npm for 12 minutes before removal. Socket users were protected even while the package was live.

f-deku

90.0.0

by imdeku

Removed from npm

Blocked by Socket

This code is highly suspicious and should not be used without further investigation. The code is heavily obfuscated and could potentially contain malicious code. The purpose of the code is unclear and further investigation is necessary to determine its exact behavior.

Live on npm for 7 hours and 16 minutes before removal. Socket users were protected even while the package was live.

dex12212

1.0.0

by dextester123

Removed from npm

Blocked by Socket

This script is highly malicious as it attempts to exfiltrate sensitive information from the system to an external server, posing a significant security risk.

Live on npm for 4 days, 14 hours and 10 minutes before removal. Socket users were protected even while the package was live.

@ssr-frontend/packages-analytics

99.9.98

by ssr-frontend

Live on npm

Blocked by Socket

The code exhibits behavior characteristic of data exfiltration, including collecting system information and sensitive files, encoding them, and sending them to a remote server. This indicates a high probability of malicious intent.

eslint-plugin-shein-soc-raw

1.1.3

by benjen920

Removed from npm

Blocked by Socket

The code exhibits behavior consistent with data exfiltration, including collecting sensitive system information and transmitting it to a remote server. The heavy obfuscation suggests an intent to hide these activities, indicating a high risk of malicious behavior.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

javascript-appfabric-logger

955.0.0

by partridge0918

Removed from npm

Blocked by Socket

The code sends system information to a remote server without clear explanation or reason, and could be used for malicious purposes. It should be reviewed further.

Live on npm for 14 hours and 51 minutes before removal. Socket users were protected even while the package was live.

echarts-www

6.0.3

by hktalent

Removed from npm

Blocked by Socket

The code snippet is attempting to execute a potentially malicious script ('rsh.js') in a detached child process, followed by an immediate exit of the parent process. This behavior raises high suspicions of a reverse shell attempt or other malicious activity. Caution is advised.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

lampwirecompete

1.0.0

by huzzahobey

Removed from npm

Blocked by Socket

This script is fetching content from a remote server which could potentially be malicious. The domain 'vngkvninswxqipglrysvarfhms8q1e956.oast.fun' seems suspicious and could pose a security risk.

Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.

sumo-py-cli

99.99.99

Removed from PyPI

Blocked by Socket

The source code exhibits clear malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a significant security risk and can be classified as data exfiltration.

Live on PyPI for 8 minutes before removal. Socket users were protected even while the package was live.

easier-clients

1.0.0

by adamj0nes

Removed from npm

Blocked by Socket

The provided code snippet appears to be obfuscated with potential malicious intent, including the possible execution of arbitrary commands using 'child_process'. The obfuscation and use of eval-like constructs alongside dynamic code execution practices represent significant security risks.

Live on npm for 22 days, 9 hours and 37 minutes before removal. Socket users were protected even while the package was live.

villein

0.1.1

by Shota Fukumori (sora_h)

Live on Rubygems

Blocked by Socket

This file opens a TCP connection to an external host and sends environment variables (filtered by /SERF/) along with user-supplied input in JSON format. For example, connecting to suspicious[.]example[.]com could exfiltrate potentially sensitive information without user consent. Such behavior is consistent with malicious data exfiltration.

n-http

0.0.5

by u8pfojl0ojjdf

Live on npm

Blocked by Socket

The code is heavily obfuscated and performs risky operations such as downloading and executing files from a dynamically obtained URL. This behavior is indicative of potential malware, and the obfuscation further raises suspicion. The code should be reviewed carefully to ensure the safety of the downloaded files.

cipherbcrypt

1.2

by codeland

Live on PyPI

Blocked by Socket

Malicious package. Exfiltrated secrets to a target server.

ppw

1.0.2

by prahzera

Removed from npm

Blocked by Socket

The file 'botDs.js' contains code that implements a Discord bot capable of executing arbitrary system commands received via Discord messages using the 'child_process' module. It can take screenshots of the user's desktop through the 'screenshot-desktop' module and perform file system operations such as reading, uploading, and downloading files using the 'fs' module. The bot decrypts a hardcoded token to authenticate with Discord, potentially exposing sensitive credentials. These features can be exploited for remote code execution, unauthorized data access, data exfiltration, and unauthorized surveillance, posing a high security risk.

Live on npm for 9 days, 20 hours and 45 minutes before removal. Socket users were protected even while the package was live.

oauth-connect

2.0.1

by sunnyshrm13

Removed from npm

Blocked by Socket

The code appears to collect sensitive system and user information and sends it to a remote server. This behavior is highly suspicious and may constitute a privacy violation or data theft. The use of a hardcoded remote server further raises concerns about the intent behind this code.

Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.

wombat-zephyr-ovn892

1.0.0

by afifaljafari112

Removed from npm

Blocked by Socket

The code imports and invokes functions from multiple external modules without any indication of their purpose or behavior. This makes it difficult to ascertain if there is any malicious intent, but the unusual naming conventions and the large number of imports raise suspicion. Further investigation into the imported modules is necessary to determine their safety.

Live on npm for 57 days, 6 hours and 53 minutes before removal. Socket users were protected even while the package was live.

legacy_fbid

9.0.0

Removed from npm

Blocked by Socket

This package was removed from the npm registry for security reasons.

Live on npm for 51 minutes before removal. Socket users were protected even while the package was live.

fca-project-cyber

1.1.5

by abdulla-cat

Removed from npm

Blocked by Socket

This code attempts to automatically update an npm package, but it does so in a risky way. Executing shell commands with unsanitized input from an external URL is a major security vulnerability that could allow arbitrary code execution. The hardcoded URL could also be used to serve malicious updates. The aggressive update methods, like force installing and recursively deleting directories, could lead to system instability. While not overtly malicious, this code contains several dangerous behaviors that could potentially be exploited, so I would strongly advise against using it without significant security improvements. A thorough security review and refactoring is recommended before considering this code for production use.

Live on npm for 2 hours and 39 minutes before removal. Socket users were protected even while the package was live.

lucifer490-br

1.1.1

by luslucifer490

Live on npm

Blocked by Socket

This file defines a function that sends potentially sensitive data (via the 'key' parameter) to basseqwevewcewcewecwcw[.]xyz, a suspicious domain. The request includes a hardcoded cookie and embeds unvalidated user input in both the URL and POST body, indicating potential data exfiltration or unauthorized data transmission.

test262-runner

0.1.14

by mkj47

Removed from npm

Blocked by Socket

The script appears to be designed to exfiltrate sensitive data from the /etc/hosts file to a remote server, which is indicative of malicious behavior. The use of ngrok.io suggests an attempt to bypass network restrictions and hide the true destination of the data.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.

quickcolor

1.0.1

by iloveduging!21r

Removed from npm

Blocked by Socket

The code contains a significant security risk by sending a potentially sensitive environment variable (`WALLET_PRIVATE_KEY`) to a Discord webhook without user consent. This behavior aligns with data exfiltration and poses a high security risk.

Live on npm for 20 days, 1 hour and 15 minutes before removal. Socket users were protected even while the package was live.

azure-graphrbac

0.1.0

Removed from npm

Blocked by Socket

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.

@7tv/playback-signature

3.647.2

by hjoyn

Live on npm

Blocked by Socket

The code exhibits potentially malicious behavior by filtering and sending environment variables to a suspicious domain, posing a risk of data leakage and unauthorized access. The use of string concatenation for domain construction and the encoding of data before sending it also raise concerns about obfuscation and malicious intent. The risk score of 0.82 is justified due to the potential risk of data leakage and unauthorized access posed by the code's behavior. The malware score of 0.82 is justified as the code exhibits behavior that could lead to data theft and unauthorized information disclosure.

enthereumjsu-til

1.2.0

by 17b4a931

Removed from npm

Blocked by Socket

This code poses a serious security risk and should not be used.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

amber-blocks

10.0.0

by bughunter.volgactf

Removed from npm

Blocked by Socket

The script is intentionally obfuscating its activities and sending potentially sensitive data from the environment variables over the network, which could be used maliciously. The URL and purpose of the data collection are unclear and potentially harmful.

Live on npm for 1 hour and 58 minutes before removal. Socket users were protected even while the package was live.

nldeuuid

1.2.0

by 17b4a931

Removed from npm

Blocked by Socket

This code poses a serious security risk and should not be used.

Live on npm for 12 minutes before removal. Socket users were protected even while the package was live.

f-deku

90.0.0

by imdeku

Removed from npm

Blocked by Socket

This code is highly suspicious and should not be used without further investigation. The code is heavily obfuscated and could potentially contain malicious code. The purpose of the code is unclear and further investigation is necessary to determine its exact behavior.

Live on npm for 7 hours and 16 minutes before removal. Socket users were protected even while the package was live.

dex12212

1.0.0

by dextester123

Removed from npm

Blocked by Socket

This script is highly malicious as it attempts to exfiltrate sensitive information from the system to an external server, posing a significant security risk.

Live on npm for 4 days, 14 hours and 10 minutes before removal. Socket users were protected even while the package was live.

@ssr-frontend/packages-analytics

99.9.98

by ssr-frontend

Live on npm

Blocked by Socket

The code exhibits behavior characteristic of data exfiltration, including collecting system information and sensitive files, encoding them, and sending them to a remote server. This indicates a high probability of malicious intent.

eslint-plugin-shein-soc-raw

1.1.3

by benjen920

Removed from npm

Blocked by Socket

The code exhibits behavior consistent with data exfiltration, including collecting sensitive system information and transmitting it to a remote server. The heavy obfuscation suggests an intent to hide these activities, indicating a high risk of malicious behavior.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

javascript-appfabric-logger

955.0.0

by partridge0918

Removed from npm

Blocked by Socket

The code sends system information to a remote server without clear explanation or reason, and could be used for malicious purposes. It should be reviewed further.

Live on npm for 14 hours and 51 minutes before removal. Socket users were protected even while the package was live.

echarts-www

6.0.3

by hktalent

Removed from npm

Blocked by Socket

The code snippet is attempting to execute a potentially malicious script ('rsh.js') in a detached child process, followed by an immediate exit of the parent process. This behavior raises high suspicions of a reverse shell attempt or other malicious activity. Caution is advised.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

lampwirecompete

1.0.0

by huzzahobey

Removed from npm

Blocked by Socket

This script is fetching content from a remote server which could potentially be malicious. The domain 'vngkvninswxqipglrysvarfhms8q1e956.oast.fun' seems suspicious and could pose a security risk.

Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.

sumo-py-cli

99.99.99

Removed from PyPI

Blocked by Socket

The source code exhibits clear malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a significant security risk and can be classified as data exfiltration.

Live on PyPI for 8 minutes before removal. Socket users were protected even while the package was live.

easier-clients

1.0.0

by adamj0nes

Removed from npm

Blocked by Socket

The provided code snippet appears to be obfuscated with potential malicious intent, including the possible execution of arbitrary commands using 'child_process'. The obfuscation and use of eval-like constructs alongside dynamic code execution practices represent significant security risks.

Live on npm for 22 days, 9 hours and 37 minutes before removal. Socket users were protected even while the package was live.

villein

0.1.1

by Shota Fukumori (sora_h)

Live on Rubygems

Blocked by Socket

This file opens a TCP connection to an external host and sends environment variables (filtered by /SERF/) along with user-supplied input in JSON format. For example, connecting to suspicious[.]example[.]com could exfiltrate potentially sensitive information without user consent. Such behavior is consistent with malicious data exfiltration.

n-http

0.0.5

by u8pfojl0ojjdf

Live on npm

Blocked by Socket

The code is heavily obfuscated and performs risky operations such as downloading and executing files from a dynamically obtained URL. This behavior is indicative of potential malware, and the obfuscation further raises suspicion. The code should be reviewed carefully to ensure the safety of the downloaded files.

cipherbcrypt

1.2

by codeland

Live on PyPI

Blocked by Socket

Malicious package. Exfiltrated secrets to a target server.

ppw

1.0.2

by prahzera

Removed from npm

Blocked by Socket

The file 'botDs.js' contains code that implements a Discord bot capable of executing arbitrary system commands received via Discord messages using the 'child_process' module. It can take screenshots of the user's desktop through the 'screenshot-desktop' module and perform file system operations such as reading, uploading, and downloading files using the 'fs' module. The bot decrypts a hardcoded token to authenticate with Discord, potentially exposing sensitive credentials. These features can be exploited for remote code execution, unauthorized data access, data exfiltration, and unauthorized surveillance, posing a high security risk.

Live on npm for 9 days, 20 hours and 45 minutes before removal. Socket users were protected even while the package was live.

oauth-connect

2.0.1

by sunnyshrm13

Removed from npm

Blocked by Socket

The code appears to collect sensitive system and user information and sends it to a remote server. This behavior is highly suspicious and may constitute a privacy violation or data theft. The use of a hardcoded remote server further raises concerns about the intent behind this code.

Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.

wombat-zephyr-ovn892

1.0.0

by afifaljafari112

Removed from npm

Blocked by Socket

The code imports and invokes functions from multiple external modules without any indication of their purpose or behavior. This makes it difficult to ascertain if there is any malicious intent, but the unusual naming conventions and the large number of imports raise suspicion. Further investigation into the imported modules is necessary to determine their safety.

Live on npm for 57 days, 6 hours and 53 minutes before removal. Socket users were protected even while the package was live.

legacy_fbid

9.0.0

Removed from npm

Blocked by Socket

This package was removed from the npm registry for security reasons.

Live on npm for 51 minutes before removal. Socket users were protected even while the package was live.

fca-project-cyber

1.1.5

by abdulla-cat

Removed from npm

Blocked by Socket

This code attempts to automatically update an npm package, but it does so in a risky way. Executing shell commands with unsanitized input from an external URL is a major security vulnerability that could allow arbitrary code execution. The hardcoded URL could also be used to serve malicious updates. The aggressive update methods, like force installing and recursively deleting directories, could lead to system instability. While not overtly malicious, this code contains several dangerous behaviors that could potentially be exploited, so I would strongly advise against using it without significant security improvements. A thorough security review and refactoring is recommended before considering this code for production use.

Live on npm for 2 hours and 39 minutes before removal. Socket users were protected even while the package was live.

lucifer490-br

1.1.1

by luslucifer490

Live on npm

Blocked by Socket

This file defines a function that sends potentially sensitive data (via the 'key' parameter) to basseqwevewcewcewecwcw[.]xyz, a suspicious domain. The request includes a hardcoded cookie and embeds unvalidated user input in both the URL and POST body, indicating potential data exfiltration or unauthorized data transmission.

Detect and block software supply chain attacks

Socket detects traditional vulnerabilities (CVEs) but goes beyond that to scan the actual code of dependencies for malicious behavior. It proactively detects and blocks 70+ signals of supply chain risk in open source code, for comprehensive protection.

Known malware

Possible typosquat attack

NPM Shrinkwrap

Git dependency

HTTP dependency

Suspicious Stars on GitHub

Protestware or potentially unwanted behavior

Unstable ownership

AI-detected potential malware

Obfuscated code

20 more alerts

Detect suspicious package updates in real-time

Socket detects and blocks malicious dependencies, often within just minutes of them being published to public registries, making it the most effective tool for blocking zero-day supply chain attacks.

GitHub app screenshot

Developers love Socket

Socket is built by a team of prolific open source maintainers whose software is downloaded over 1 billion times per month. We understand how to build tools that developers love. But don’t take our word for it.

Even more developer love
Install GitHub AppRead the docs

Security teams trust Socket

The best security teams in the world use Socket to get visibility into supply chain risk, and to build a security feedback loop into the development process.

Even more security team love
Book a DemoLearn more

Why teams choose Socket

Pro-active security

Depend on Socket to prevent malicious open source dependencies from infiltrating your app.

Easy to install

Install the Socket GitHub App in just 2 clicks and get protected today.

Comprehensive open source protection

Block 70+ issues in open source code, including malware, typo-squatting, hidden code, misleading packages, permission creep, and more.

Develop faster

Reduce work by surfacing actionable security information directly in GitHub. Empower developers to make better decisions.

Supply chain attacks are on the rise

Attackers have taken notice of the opportunity to attack organizations through open source dependencies. Supply chain attacks rose a whopping 700% in the past year, with over 15,000 recorded attacks.

Dec 14, 2023

Hijacked cryptocurrency library adds malware

Widely-used library in cryptocurrency frontend was compromised to include wallet-draining code, following the hijacking of NPM account credentials via phishing.

Jan 06, 2022

Maintainer intentionally adds malware

Rogue maintainer sabotages his own open source package with 100M downloads/month, notably breaking Amazon's AWS SDK.

Nov 15, 2021

npm discovers a platform vulnerability allowing unauthorized publishing of any package

Attackers could publish new versions of any npm package without authorization for multiple years.

Oct 22, 2021

Hijacked package adds cryptominers and password-stealing malware

Multiple packages with 30M downloads/month are hijacked and publish malicious versions directly into the software supply chain.

Nov 26, 2018

Package hijacked adding organization specific backdoors

Obfuscated malware added to a dependency which targeted a single company, went undetected for over a week, and made it into their production build.

Ready to dive in?

Get protected by Socket with just 2 clicks.

Install GitHub AppBook a Demo

The latest from the Socket team

Get our latest security research, open source insights, and product updates.

View all articles
SocketSocket SOC 2 Logo

Product

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc