Secure your dependencies. Ship with confidence.

This script is attempting to ping a remote host, which could be a sign of data exfiltration or communication with a malicious server. This behavior raises security concerns.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code exhibits clear signs of malicious behavior by exfiltrating system and user data to external servers without user consent. This poses a significant security risk due to unauthorized data transmission and potential exposure of sensitive information.

Live on npm for 1 hour and 6 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious and unprofessional behaviors including fetching updates from a non-standard repository, potentially misleading error handling, and providing a contact URL with inappropriate content. These anomalies suggest the code could have malicious intent or might be part of a supply chain attack.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

The code checks for updates of a specific package and attempts to update it if a newer version is available. However, there are several potential security risks and trustworthiness concerns in the code. It uses a hardcoded URL, performs synchronous operations with execSync, logs sensitive information, calls process.exit, and catches errors without further action. Additionally, the code references a Facebook URL and uses fs.rmdirSync to remove a directory. These behaviors raise concerns about potential security risks and the overall trustworthiness of the code.

Live on npm for 29 days, 8 hours and 34 minutes before removal. Socket users were protected even while the package was live.

The code is designed to extract a user's Discord token and send it along with their data to a third-party Discord webhook. This is a data exfiltration attempt and is malicious behavior. It appears to be an attempt to use stolen tokens to access Discord user accounts and extract information.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk due to the execution of a remote script without validation, which could lead to unauthorized code execution and system compromise.

Live on npm for 12 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive data (the contents of the '/etc/passwd' file) to a remote server. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect sensitive system information and transmit it to an external server using obfuscated methods. This behavior is indicative of malicious activity, specifically data exfiltration.

Live on npm for 24 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potential security risks due to its complexity and the use of the 'eval' function with untrusted input. It is recommended to review and potentially refactor the code to avoid these security issues.

Live on pypi for 3 days, 20 hours and 4 minutes before removal. Socket users were protected even while the package was live.

This script executes a local JavaScript file and then deletes it. This behavior is potentially suspicious and could be used to hide malicious code or cover tracks.

Live on npm for 7 hours and 45 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by obfuscating its functionality, executing system commands, and sending the output to an external server. This indicates a potential security risk and malicious intent.

Live on npm for 5 hours and 54 minutes before removal. Socket users were protected even while the package was live.

This code is highly suspicious and poses a significant security risk. It should be investigated further for potential malicious behavior.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.

This script is designed to send sensitive information (username and current path) to an external server, which poses a significant security risk and is indicative of malicious behavior.

Live on npm for 16 days, 14 hours and 28 minutes before removal. Socket users were protected even while the package was live.

This code is malicious and poses a significant security risk. It should be removed immediately and reported to the appropriate authorities.

Live on npm for 99 days, 1 hour and 40 minutes before removal. Socket users were protected even while the package was live.

The provided source code establishes a reverse shell, which is a serious security threat. It allows remote execution of commands on the affected system, posing a high security risk.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

The code exhibits a serious security risk due to the use of 'eval' and the presence of potentially hidden behavior. Refactoring is necessary to address these risks.

Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This package was removed from the npm registry for security reasons.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

The code is designed to collect and send system information to a remote server, which is a behavior commonly associated with malicious intent or a reconnaissance phase of an attack. The hard-coded URL and the specific data points collected raise significant security concerns.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code contains potential security risks, including arbitrary code execution through unvalidated script paths and Docker image references. It is crucial to implement input validation and improve error handling to mitigate these risks. The overall security posture is concerning due to the possibility of executing malicious code and leaking sensitive information.

The package's 'preinstall' script collects sensitive system information including the hostname, current user, network configuration, current directory, and user ID. It sends this data via an HTTP POST request to 'j1lx25fxmrxczvui5yjbfc99j0pxds1h[.]oastify[.]com', constituting unauthorized data exfiltration and indicating malicious intent.

This script is attempting to ping a remote host, which could be a sign of data exfiltration or communication with a malicious server. This behavior raises security concerns.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code exhibits clear signs of malicious behavior by exfiltrating system and user data to external servers without user consent. This poses a significant security risk due to unauthorized data transmission and potential exposure of sensitive information.

Live on npm for 1 hour and 6 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious and unprofessional behaviors including fetching updates from a non-standard repository, potentially misleading error handling, and providing a contact URL with inappropriate content. These anomalies suggest the code could have malicious intent or might be part of a supply chain attack.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

The code checks for updates of a specific package and attempts to update it if a newer version is available. However, there are several potential security risks and trustworthiness concerns in the code. It uses a hardcoded URL, performs synchronous operations with execSync, logs sensitive information, calls process.exit, and catches errors without further action. Additionally, the code references a Facebook URL and uses fs.rmdirSync to remove a directory. These behaviors raise concerns about potential security risks and the overall trustworthiness of the code.

Live on npm for 29 days, 8 hours and 34 minutes before removal. Socket users were protected even while the package was live.

The code is designed to extract a user's Discord token and send it along with their data to a third-party Discord webhook. This is a data exfiltration attempt and is malicious behavior. It appears to be an attempt to use stolen tokens to access Discord user accounts and extract information.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk due to the execution of a remote script without validation, which could lead to unauthorized code execution and system compromise.

Live on npm for 12 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive data (the contents of the '/etc/passwd' file) to a remote server. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect sensitive system information and transmit it to an external server using obfuscated methods. This behavior is indicative of malicious activity, specifically data exfiltration.

Live on npm for 24 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potential security risks due to its complexity and the use of the 'eval' function with untrusted input. It is recommended to review and potentially refactor the code to avoid these security issues.

Live on pypi for 3 days, 20 hours and 4 minutes before removal. Socket users were protected even while the package was live.

This script executes a local JavaScript file and then deletes it. This behavior is potentially suspicious and could be used to hide malicious code or cover tracks.

Live on npm for 7 hours and 45 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by obfuscating its functionality, executing system commands, and sending the output to an external server. This indicates a potential security risk and malicious intent.

Live on npm for 5 hours and 54 minutes before removal. Socket users were protected even while the package was live.

This code is highly suspicious and poses a significant security risk. It should be investigated further for potential malicious behavior.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.

This script is designed to send sensitive information (username and current path) to an external server, which poses a significant security risk and is indicative of malicious behavior.

Live on npm for 16 days, 14 hours and 28 minutes before removal. Socket users were protected even while the package was live.

This code is malicious and poses a significant security risk. It should be removed immediately and reported to the appropriate authorities.

Live on npm for 99 days, 1 hour and 40 minutes before removal. Socket users were protected even while the package was live.

The provided source code establishes a reverse shell, which is a serious security threat. It allows remote execution of commands on the affected system, posing a high security risk.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

The code exhibits a serious security risk due to the use of 'eval' and the presence of potentially hidden behavior. Refactoring is necessary to address these risks.

Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This package was removed from the npm registry for security reasons.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

The code is designed to collect and send system information to a remote server, which is a behavior commonly associated with malicious intent or a reconnaissance phase of an attack. The hard-coded URL and the specific data points collected raise significant security concerns.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code contains potential security risks, including arbitrary code execution through unvalidated script paths and Docker image references. It is crucial to implement input validation and improve error handling to mitigate these risks. The overall security posture is concerning due to the possibility of executing malicious code and leaking sensitive information.

The package's 'preinstall' script collects sensitive system information including the hostname, current user, network configuration, current directory, and user ID. It sends this data via an HTTP POST request to 'j1lx25fxmrxczvui5yjbfc99j0pxds1h[.]oastify[.]com', constituting unauthorized data exfiltration and indicating malicious intent.