
Security News
Create React App Officially Deprecated Amid React 19 Compatibility Issues
Create React App is officially deprecated due to React 19 issues and lack of maintenance—developers should switch to Vite or other modern alternatives.
Quickly evaluate the security and health of any open source package.
test262-runner
0.1.14
by mkj47
Removed from npm
Blocked by Socket
The script appears to be designed to exfiltrate sensitive data from the /etc/hosts file to a remote server, which is indicative of malicious behavior. The use of ngrok.io suggests an attempt to bypass network restrictions and hide the true destination of the data.
Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.
quickcolor
1.0.1
by iloveduging!21r
Removed from npm
Blocked by Socket
The code contains a significant security risk by sending a potentially sensitive environment variable (`WALLET_PRIVATE_KEY`) to a Discord webhook without user consent. This behavior aligns with data exfiltration and poses a high security risk.
Live on npm for 20 days, 1 hour and 15 minutes before removal. Socket users were protected even while the package was live.
azure-graphrbac
0.1.0
Removed from npm
Blocked by Socket
Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package
Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.
@7tv/playback-signature
3.647.2
by hjoyn
Live on npm
Blocked by Socket
The code exhibits potentially malicious behavior by filtering and sending environment variables to a suspicious domain, posing a risk of data leakage and unauthorized access. The use of string concatenation for domain construction and the encoding of data before sending it also raise concerns about obfuscation and malicious intent. The risk score of 0.82 is justified due to the potential risk of data leakage and unauthorized access posed by the code's behavior. The malware score of 0.82 is justified as the code exhibits behavior that could lead to data theft and unauthorized information disclosure.
enthereumjsu-til
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.
amber-blocks
10.0.0
by bughunter.volgactf
Removed from npm
Blocked by Socket
The script is intentionally obfuscating its activities and sending potentially sensitive data from the environment variables over the network, which could be used maliciously. The URL and purpose of the data collection are unclear and potentially harmful.
Live on npm for 1 hour and 58 minutes before removal. Socket users were protected even while the package was live.
nldeuuid
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 12 minutes before removal. Socket users were protected even while the package was live.
f-deku
90.0.0
by imdeku
Removed from npm
Blocked by Socket
This code is highly suspicious and should not be used without further investigation. The code is heavily obfuscated and could potentially contain malicious code. The purpose of the code is unclear and further investigation is necessary to determine its exact behavior.
Live on npm for 7 hours and 16 minutes before removal. Socket users were protected even while the package was live.
dex12212
1.0.0
by dextester123
Removed from npm
Blocked by Socket
This script is highly malicious as it attempts to exfiltrate sensitive information from the system to an external server, posing a significant security risk.
Live on npm for 4 days, 14 hours and 10 minutes before removal. Socket users were protected even while the package was live.
@ssr-frontend/packages-analytics
99.9.98
by ssr-frontend
Live on npm
Blocked by Socket
The code exhibits behavior characteristic of data exfiltration, including collecting system information and sensitive files, encoding them, and sending them to a remote server. This indicates a high probability of malicious intent.
eslint-plugin-shein-soc-raw
1.1.3
by benjen920
Removed from npm
Blocked by Socket
The code exhibits behavior consistent with data exfiltration, including collecting sensitive system information and transmitting it to a remote server. The heavy obfuscation suggests an intent to hide these activities, indicating a high risk of malicious behavior.
Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.
javascript-appfabric-logger
955.0.0
by partridge0918
Removed from npm
Blocked by Socket
The code sends system information to a remote server without clear explanation or reason, and could be used for malicious purposes. It should be reviewed further.
Live on npm for 14 hours and 51 minutes before removal. Socket users were protected even while the package was live.
echarts-www
6.0.3
by hktalent
Removed from npm
Blocked by Socket
The code snippet is attempting to execute a potentially malicious script ('rsh.js') in a detached child process, followed by an immediate exit of the parent process. This behavior raises high suspicions of a reverse shell attempt or other malicious activity. Caution is advised.
Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.
lampwirecompete
1.0.0
by huzzahobey
Removed from npm
Blocked by Socket
This script is fetching content from a remote server which could potentially be malicious. The domain 'vngkvninswxqipglrysvarfhms8q1e956.oast.fun' seems suspicious and could pose a security risk.
Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.
sumo-py-cli
99.99.99
Removed from PyPI
Blocked by Socket
The source code exhibits clear malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a significant security risk and can be classified as data exfiltration.
Live on PyPI for 8 minutes before removal. Socket users were protected even while the package was live.
easier-clients
1.0.0
by adamj0nes
Removed from npm
Blocked by Socket
The provided code snippet appears to be obfuscated with potential malicious intent, including the possible execution of arbitrary commands using 'child_process'. The obfuscation and use of eval-like constructs alongside dynamic code execution practices represent significant security risks.
Live on npm for 22 days, 9 hours and 37 minutes before removal. Socket users were protected even while the package was live.
villein
0.1.1
by Shota Fukumori (sora_h)
Live on Rubygems
Blocked by Socket
This file opens a TCP connection to an external host and sends environment variables (filtered by /SERF/) along with user-supplied input in JSON format. For example, connecting to suspicious[.]example[.]com could exfiltrate potentially sensitive information without user consent. Such behavior is consistent with malicious data exfiltration.
n-http
0.0.5
by u8pfojl0ojjdf
Live on npm
Blocked by Socket
The code is heavily obfuscated and performs risky operations such as downloading and executing files from a dynamically obtained URL. This behavior is indicative of potential malware, and the obfuscation further raises suspicion. The code should be reviewed carefully to ensure the safety of the downloaded files.
cipherbcrypt
1.2
by codeland
Live on PyPI
Blocked by Socket
Malicious package. Exfiltrated secrets to a target server.
ppw
1.0.2
by prahzera
Removed from npm
Blocked by Socket
The file 'botDs.js' contains code that implements a Discord bot capable of executing arbitrary system commands received via Discord messages using the 'child_process' module. It can take screenshots of the user's desktop through the 'screenshot-desktop' module and perform file system operations such as reading, uploading, and downloading files using the 'fs' module. The bot decrypts a hardcoded token to authenticate with Discord, potentially exposing sensitive credentials. These features can be exploited for remote code execution, unauthorized data access, data exfiltration, and unauthorized surveillance, posing a high security risk.
Live on npm for 9 days, 20 hours and 45 minutes before removal. Socket users were protected even while the package was live.
oauth-connect
2.0.1
by sunnyshrm13
Removed from npm
Blocked by Socket
The code appears to collect sensitive system and user information and sends it to a remote server. This behavior is highly suspicious and may constitute a privacy violation or data theft. The use of a hardcoded remote server further raises concerns about the intent behind this code.
Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.
wombat-zephyr-ovn892
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code imports and invokes functions from multiple external modules without any indication of their purpose or behavior. This makes it difficult to ascertain if there is any malicious intent, but the unusual naming conventions and the large number of imports raise suspicion. Further investigation into the imported modules is necessary to determine their safety.
Live on npm for 57 days, 6 hours and 53 minutes before removal. Socket users were protected even while the package was live.
legacy_fbid
9.0.0
Removed from npm
Blocked by Socket
This package was removed from the npm registry for security reasons.
Live on npm for 51 minutes before removal. Socket users were protected even while the package was live.
fca-project-cyber
1.1.5
by abdulla-cat
Removed from npm
Blocked by Socket
This code attempts to automatically update an npm package, but it does so in a risky way. Executing shell commands with unsanitized input from an external URL is a major security vulnerability that could allow arbitrary code execution. The hardcoded URL could also be used to serve malicious updates. The aggressive update methods, like force installing and recursively deleting directories, could lead to system instability. While not overtly malicious, this code contains several dangerous behaviors that could potentially be exploited, so I would strongly advise against using it without significant security improvements. A thorough security review and refactoring is recommended before considering this code for production use.
Live on npm for 2 hours and 39 minutes before removal. Socket users were protected even while the package was live.
lucifer490-br
1.1.1
by luslucifer490
Live on npm
Blocked by Socket
This file defines a function that sends potentially sensitive data (via the 'key' parameter) to basseqwevewcewcewecwcw[.]xyz, a suspicious domain. The request includes a hardcoded cookie and embeds unvalidated user input in both the URL and POST body, indicating potential data exfiltration or unauthorized data transmission.
test262-runner
0.1.14
by mkj47
Removed from npm
Blocked by Socket
The script appears to be designed to exfiltrate sensitive data from the /etc/hosts file to a remote server, which is indicative of malicious behavior. The use of ngrok.io suggests an attempt to bypass network restrictions and hide the true destination of the data.
Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.
quickcolor
1.0.1
by iloveduging!21r
Removed from npm
Blocked by Socket
The code contains a significant security risk by sending a potentially sensitive environment variable (`WALLET_PRIVATE_KEY`) to a Discord webhook without user consent. This behavior aligns with data exfiltration and poses a high security risk.
Live on npm for 20 days, 1 hour and 15 minutes before removal. Socket users were protected even while the package was live.
azure-graphrbac
0.1.0
Removed from npm
Blocked by Socket
Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package
Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.
@7tv/playback-signature
3.647.2
by hjoyn
Live on npm
Blocked by Socket
The code exhibits potentially malicious behavior by filtering and sending environment variables to a suspicious domain, posing a risk of data leakage and unauthorized access. The use of string concatenation for domain construction and the encoding of data before sending it also raise concerns about obfuscation and malicious intent. The risk score of 0.82 is justified due to the potential risk of data leakage and unauthorized access posed by the code's behavior. The malware score of 0.82 is justified as the code exhibits behavior that could lead to data theft and unauthorized information disclosure.
enthereumjsu-til
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.
amber-blocks
10.0.0
by bughunter.volgactf
Removed from npm
Blocked by Socket
The script is intentionally obfuscating its activities and sending potentially sensitive data from the environment variables over the network, which could be used maliciously. The URL and purpose of the data collection are unclear and potentially harmful.
Live on npm for 1 hour and 58 minutes before removal. Socket users were protected even while the package was live.
nldeuuid
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 12 minutes before removal. Socket users were protected even while the package was live.
f-deku
90.0.0
by imdeku
Removed from npm
Blocked by Socket
This code is highly suspicious and should not be used without further investigation. The code is heavily obfuscated and could potentially contain malicious code. The purpose of the code is unclear and further investigation is necessary to determine its exact behavior.
Live on npm for 7 hours and 16 minutes before removal. Socket users were protected even while the package was live.
dex12212
1.0.0
by dextester123
Removed from npm
Blocked by Socket
This script is highly malicious as it attempts to exfiltrate sensitive information from the system to an external server, posing a significant security risk.
Live on npm for 4 days, 14 hours and 10 minutes before removal. Socket users were protected even while the package was live.
@ssr-frontend/packages-analytics
99.9.98
by ssr-frontend
Live on npm
Blocked by Socket
The code exhibits behavior characteristic of data exfiltration, including collecting system information and sensitive files, encoding them, and sending them to a remote server. This indicates a high probability of malicious intent.
eslint-plugin-shein-soc-raw
1.1.3
by benjen920
Removed from npm
Blocked by Socket
The code exhibits behavior consistent with data exfiltration, including collecting sensitive system information and transmitting it to a remote server. The heavy obfuscation suggests an intent to hide these activities, indicating a high risk of malicious behavior.
Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.
javascript-appfabric-logger
955.0.0
by partridge0918
Removed from npm
Blocked by Socket
The code sends system information to a remote server without clear explanation or reason, and could be used for malicious purposes. It should be reviewed further.
Live on npm for 14 hours and 51 minutes before removal. Socket users were protected even while the package was live.
echarts-www
6.0.3
by hktalent
Removed from npm
Blocked by Socket
The code snippet is attempting to execute a potentially malicious script ('rsh.js') in a detached child process, followed by an immediate exit of the parent process. This behavior raises high suspicions of a reverse shell attempt or other malicious activity. Caution is advised.
Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.
lampwirecompete
1.0.0
by huzzahobey
Removed from npm
Blocked by Socket
This script is fetching content from a remote server which could potentially be malicious. The domain 'vngkvninswxqipglrysvarfhms8q1e956.oast.fun' seems suspicious and could pose a security risk.
Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.
sumo-py-cli
99.99.99
Removed from PyPI
Blocked by Socket
The source code exhibits clear malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a significant security risk and can be classified as data exfiltration.
Live on PyPI for 8 minutes before removal. Socket users were protected even while the package was live.
easier-clients
1.0.0
by adamj0nes
Removed from npm
Blocked by Socket
The provided code snippet appears to be obfuscated with potential malicious intent, including the possible execution of arbitrary commands using 'child_process'. The obfuscation and use of eval-like constructs alongside dynamic code execution practices represent significant security risks.
Live on npm for 22 days, 9 hours and 37 minutes before removal. Socket users were protected even while the package was live.
villein
0.1.1
by Shota Fukumori (sora_h)
Live on Rubygems
Blocked by Socket
This file opens a TCP connection to an external host and sends environment variables (filtered by /SERF/) along with user-supplied input in JSON format. For example, connecting to suspicious[.]example[.]com could exfiltrate potentially sensitive information without user consent. Such behavior is consistent with malicious data exfiltration.
n-http
0.0.5
by u8pfojl0ojjdf
Live on npm
Blocked by Socket
The code is heavily obfuscated and performs risky operations such as downloading and executing files from a dynamically obtained URL. This behavior is indicative of potential malware, and the obfuscation further raises suspicion. The code should be reviewed carefully to ensure the safety of the downloaded files.
cipherbcrypt
1.2
by codeland
Live on PyPI
Blocked by Socket
Malicious package. Exfiltrated secrets to a target server.
ppw
1.0.2
by prahzera
Removed from npm
Blocked by Socket
The file 'botDs.js' contains code that implements a Discord bot capable of executing arbitrary system commands received via Discord messages using the 'child_process' module. It can take screenshots of the user's desktop through the 'screenshot-desktop' module and perform file system operations such as reading, uploading, and downloading files using the 'fs' module. The bot decrypts a hardcoded token to authenticate with Discord, potentially exposing sensitive credentials. These features can be exploited for remote code execution, unauthorized data access, data exfiltration, and unauthorized surveillance, posing a high security risk.
Live on npm for 9 days, 20 hours and 45 minutes before removal. Socket users were protected even while the package was live.
oauth-connect
2.0.1
by sunnyshrm13
Removed from npm
Blocked by Socket
The code appears to collect sensitive system and user information and sends it to a remote server. This behavior is highly suspicious and may constitute a privacy violation or data theft. The use of a hardcoded remote server further raises concerns about the intent behind this code.
Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.
wombat-zephyr-ovn892
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code imports and invokes functions from multiple external modules without any indication of their purpose or behavior. This makes it difficult to ascertain if there is any malicious intent, but the unusual naming conventions and the large number of imports raise suspicion. Further investigation into the imported modules is necessary to determine their safety.
Live on npm for 57 days, 6 hours and 53 minutes before removal. Socket users were protected even while the package was live.
legacy_fbid
9.0.0
Removed from npm
Blocked by Socket
This package was removed from the npm registry for security reasons.
Live on npm for 51 minutes before removal. Socket users were protected even while the package was live.
fca-project-cyber
1.1.5
by abdulla-cat
Removed from npm
Blocked by Socket
This code attempts to automatically update an npm package, but it does so in a risky way. Executing shell commands with unsanitized input from an external URL is a major security vulnerability that could allow arbitrary code execution. The hardcoded URL could also be used to serve malicious updates. The aggressive update methods, like force installing and recursively deleting directories, could lead to system instability. While not overtly malicious, this code contains several dangerous behaviors that could potentially be exploited, so I would strongly advise against using it without significant security improvements. A thorough security review and refactoring is recommended before considering this code for production use.
Live on npm for 2 hours and 39 minutes before removal. Socket users were protected even while the package was live.
lucifer490-br
1.1.1
by luslucifer490
Live on npm
Blocked by Socket
This file defines a function that sends potentially sensitive data (via the 'key' parameter) to basseqwevewcewcewecwcw[.]xyz, a suspicious domain. The request includes a hardcoded cookie and embeds unvalidated user input in both the URL and POST body, indicating potential data exfiltration or unauthorized data transmission.
Socket detects traditional vulnerabilities (CVEs) but goes beyond that to scan the actual code of dependencies for malicious behavior. It proactively detects and blocks 70+ signals of supply chain risk in open source code, for comprehensive protection.
Known malware
Possible typosquat attack
NPM Shrinkwrap
Git dependency
HTTP dependency
Suspicious Stars on GitHub
Protestware or potentially unwanted behavior
Unstable ownership
AI-detected potential malware
Obfuscated code
20 more alerts →
Bad dependency semver
Wildcard dependency
Unpopular package
Minified code
Socket optimized override available
Deprecated
Unmaintained
Critical CVE
High CVE
Medium CVE
Low CVE
Explicitly Unlicensed Item
License Policy Violation
Misc. License Issues
Non-permissive License
Ambiguous License Classifier
Copyleft License
Unidentified License
No License Found
License exception
Socket detects and blocks malicious dependencies, often within just minutes of them being published to public registries, making it the most effective tool for blocking zero-day supply chain attacks.
Socket is built by a team of prolific open source maintainers whose software is downloaded over 1 billion times per month. We understand how to build tools that developers love. But don’t take our word for it.
Nat Friedman
CEO at GitHub
Congrats to @feross and the hard-working team behind @SocketSecurity on today's launch!
Suz Hinton
Senior Software Engineer at Stripe
heck yes this is awesome!!! Congrats team 🎉👏
Matteo Collina
Node.js maintainer, Fastify lead maintainer
So awesome to see @SocketSecurity launch with a fresh approach! Excited to have supported the team from the early days.
DC Posch
Director of Technology at AppFolio, CTO at Dynasty
This is going to be super important, especially for crypto projects where a compromised dependency results in stolen user assets.
Luis Naranjo
Software Engineer at Microsoft
If software supply chain attacks through npm don't scare the shit out of you, you're not paying close enough attention.
@SocketSecurity sounds like an awesome product. I'll be using socket.dev instead of npmjs.org to browse npm packages going forward
Elena Nadolinski
Founder and CEO at Iron Fish
Huge congrats to @SocketSecurity! 🙌
Literally the only product that proactively detects signs of JS compromised packages.
Joe Previte
Engineering Team Lead at Coder
Congrats to @feross and the @SocketSecurity team on their seed funding! 🚀 It's been a big help for us at @CoderHQ and we appreciate what y'all are doing!
Josh Goldberg
Staff Developer at Codecademy
This is such a great idea & looks fantastic, congrats & good luck @feross + team!
The best security teams in the world use Socket to get visibility into supply chain risk, and to build a security feedback loop into the development process.
Yan Zhu
Head of Security at Brave, DEFCON, EFF, W3C
glad to hear some of the smartest people i know are working on (npm, etc.) supply chain security finally :). @SocketSecurity
Andrew Peterson
CEO and Co-Founder at Signal Sciences (acq. Fastly)
How do you track the validity of open source software libraries as they get updated? You're prob not. Check out @SocketSecurity and the updated tooling they launched.
Supply chain is a cluster in security as we all know and the tools from Socket are "duh" type tools to be implementing.
Zbyszek Tenerowicz
Senior Security Engineer at ConsenSys
socket.dev is getting more appealing by the hour
Devdatta Akhawe
Head of Security at Figma
The @SocketSecurity team is on fire! Amazing progress and I am exciting to see where they go next.
Ryan Noon
Founder & CEO at Material Security
The NPM ecosystem is a horrible horrible place and I'm glad you're doing something about it.
Sebastian Bensusan
Engineer Manager at Stripe
I find it surprising that we don't have _more_ supply chain attacks in software:
Imagine your airplane (the code running) was assembled (deployed) daily, with parts (dependencies) from internet strangers. How long until you get a bad part?
Excited for Socket to prevent this
Adam Baldwin
VP of Security at npm, Red Team at Auth0/Okta
Congrats to everyone at @SocketSecurity ❤️🤘🏻
Nico Waisman
CISO at Lyft
This is an area that I have personally been very focused on. As Nat Friedman said in the 2019 GitHub Universe keynote, Open Source won, and every time you add a new open source project you rely on someone else's code and you rely on the people that build it.
This is both exciting and problematic. You are bringing real risk into your organization, and I'm excited to see progress in the industry from OpenSSF scorecards and package analyzers to the company that Feross Aboukhadijeh is building!
Depend on Socket to prevent malicious open source dependencies from infiltrating your app.
Install the Socket GitHub App in just 2 clicks and get protected today.
Block 70+ issues in open source code, including malware, typo-squatting, hidden code, misleading packages, permission creep, and more.
Reduce work by surfacing actionable security information directly in GitHub. Empower developers to make better decisions.
Attackers have taken notice of the opportunity to attack organizations through open source dependencies. Supply chain attacks rose a whopping 700% in the past year, with over 15,000 recorded attacks.
Dec 14, 2023
Hijacked cryptocurrency library adds malware
Widely-used library in cryptocurrency frontend was compromised to include wallet-draining code, following the hijacking of NPM account credentials via phishing.
Jan 06, 2022
Maintainer intentionally adds malware
Rogue maintainer sabotages his own open source package with 100M downloads/month, notably breaking Amazon's AWS SDK.
Nov 15, 2021
npm discovers a platform vulnerability allowing unauthorized publishing of any package
Attackers could publish new versions of any npm package without authorization for multiple years.
Oct 22, 2021
Hijacked package adds cryptominers and password-stealing malware
Multiple packages with 30M downloads/month are hijacked and publish malicious versions directly into the software supply chain.
Nov 26, 2018
Package hijacked adding organization specific backdoors
Obfuscated malware added to a dependency which targeted a single company, went undetected for over a week, and made it into their production build.
Get our latest security research, open source insights, and product updates.
Security News
Create React App is officially deprecated due to React 19 issues and lack of maintenance—developers should switch to Vite or other modern alternatives.
Security News
Oracle seeks to dismiss fraud claims in the JavaScript trademark dispute, delaying the case and avoiding questions about its right to the name.
Security News
The Linux Foundation is warning open source developers that compliance with global sanctions is mandatory, highlighting legal risks and restrictions on contributions.