Secure your dependencies. Ship with confidence.

The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.

Live on npm for 2 hours and 54 minutes before removal. Socket users were protected even while the package was live.

The code establishes a reverse shell connection to a remote server without clear purpose or context, raising concerns about unauthorized access or control. Further investigation is needed to fully assess the security risks and intent of this code.

Live on npm for 2 days, 15 hours and 48 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 hour and 29 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by exfiltrating system and project data to external servers without user consent. This poses a significant security risk and aligns with tactics used in malware.

Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 4 hours and 23 minutes before removal. Socket users were protected even while the package was live.

Malicious code in gae-scaffold (npm) Source: ghsa-malware (7fa0c6991b3823bfad7ac72276d2355a97e46c69912781af0872d99113be09d4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 49 minutes before removal. Socket users were protected even while the package was live.

Malicious code in ota-generator (npm) Source: ghsa-malware (8b649de88a8d4cf275fb965bdcb313788f4c6d62c0744bcfd2a09442bc022259) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 29 minutes before removal. Socket users were protected even while the package was live.

This code exhibits ransomware-like behavior by encrypting and overwriting files in the directory without user consent. The function reads all files in the current directory (excluding itself), encrypts a hardcoded message using AES encryption with a randomly generated UUID as the key, and overwrites each file with this encrypted content. This destructive action leads to data loss as original file contents are replaced with ciphertext, rendering them inaccessible to users.

Live on npm for 15 days, 20 hours and 21 minutes before removal. Socket users were protected even while the package was live.

The code is potentially malicious as it sends environment variables to a remote server with an obfuscated domain, indicating possible data exfiltration.

Live on npm for 1 hour and 27 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

The source code includes a network request that could potentially send system data over the network, justifying a higher malware and risk score. Debug logging could expose sensitive information if not properly controlled.

Live on npm for 4 hours and 23 minutes before removal. Socket users were protected even while the package was live.

The code presents a high security risk due to the potential leakage of sensitive system information and insecure network communication. It is crucial to address the lack of error handling and implement secure data handling practices. Malware score: 0.8, Obfuscated score: 0.7, Security risk score: 0.9

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

This code sends an HTTP request to a remote server with sensitive system information, including the hostname, username, and current working directory. This behavior is considered suspicious and potentially malicious. The user should review the purpose of this script and the server receiving the request.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

This script is exfiltrating system information to a remote server without the user's consent. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 35 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior by sending environment variables to an external server. The use of obfuscation techniques and the suspicious domain further raise concerns.

Live on npm for 57 minutes before removal. Socket users were protected even while the package was live.

The script is designed to send sensitive information about the user and the system to an external server, which is a clear indication of malicious behavior.

Live on npm for 7 days, 14 hours and 57 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and exfiltrating sensitive system information to a potentially malicious domain. The use of execSync and insecure HTTPS configuration further increases the security risk.

The primary concern with this code is the use of 'exec' to execute scripts fetched from the internet without validation. This poses a significant security risk as it can potentially execute malicious code. The use of 'os.spawnle' and 'subprocess.Popen' with user-provided inputs also adds to the security concerns. Additionally, there is a typo in 'Optarser' and incomplete handling of the temporary directory cleanup. http://python-distribute.org/distribute_setup.py was marked as Malicious by 1 engine in VT. https://www.virustotal.com/gui/url/3dce83785eafd47d40edd58b58c82593994cd409fc76351033486881fe943c36

The script exhibits clear signs of malicious behavior by collecting and sending sensitive system information to an external server. The use of base64 encoding, while not strong obfuscation, is a technique often used to slightly obscure data. The external server communication poses a significant security risk.

Live on npm for 34 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect and send sensitive information to a remote server without the user's knowledge or consent. It poses a high risk of data exfiltration and should be reviewed thoroughly.

Live on npm for 41 minutes before removal. Socket users were protected even while the package was live.

The code exhibits behavior consistent with data exfiltration by sending environment variables to a suspicious domain. This poses a significant security risk due to potential exposure of sensitive information.

Live on npm for 4 hours and 7 minutes before removal. Socket users were protected even while the package was live.

The code reads sensitive system files including '/etc/passwd' and collects system information such as the home directory, hostname, username, DNS servers, and package details. This data is sent via an HTTPS POST request to a remote server at 'juha9he7uuz32n81la0aui0kqbw2kt8i[.]oastify[.]com' without user consent, posing a significant security risk due to unauthorized data exfiltration.

Live on npm for 1 day, 3 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code sets up a WebSocket proxy server that decrypts incoming messages using a secret key and forwards them to a remote server. However, it has potential security risks such as the use of potentially hard-coded encryption key and the lack of input validation and authentication/authorization checks. It is important to review and enhance the security measures before using this code in a production environment.

Live on npm for 44 days and 49 minutes before removal. Socket users were protected even while the package was live.

Malicious code in es6shsm (npm) Source: ghsa-malware (532e251435e5aa43412f0a3d67927aad3b0df8a7a31d174bc651cda37d917934) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.

Live on npm for 2 hours and 54 minutes before removal. Socket users were protected even while the package was live.

The code establishes a reverse shell connection to a remote server without clear purpose or context, raising concerns about unauthorized access or control. Further investigation is needed to fully assess the security risks and intent of this code.

Live on npm for 2 days, 15 hours and 48 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 hour and 29 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by exfiltrating system and project data to external servers without user consent. This poses a significant security risk and aligns with tactics used in malware.

Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 4 hours and 23 minutes before removal. Socket users were protected even while the package was live.

Malicious code in gae-scaffold (npm) Source: ghsa-malware (7fa0c6991b3823bfad7ac72276d2355a97e46c69912781af0872d99113be09d4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 49 minutes before removal. Socket users were protected even while the package was live.

Malicious code in ota-generator (npm) Source: ghsa-malware (8b649de88a8d4cf275fb965bdcb313788f4c6d62c0744bcfd2a09442bc022259) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 29 minutes before removal. Socket users were protected even while the package was live.

This code exhibits ransomware-like behavior by encrypting and overwriting files in the directory without user consent. The function reads all files in the current directory (excluding itself), encrypts a hardcoded message using AES encryption with a randomly generated UUID as the key, and overwrites each file with this encrypted content. This destructive action leads to data loss as original file contents are replaced with ciphertext, rendering them inaccessible to users.

Live on npm for 15 days, 20 hours and 21 minutes before removal. Socket users were protected even while the package was live.

The code is potentially malicious as it sends environment variables to a remote server with an obfuscated domain, indicating possible data exfiltration.

Live on npm for 1 hour and 27 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

The source code includes a network request that could potentially send system data over the network, justifying a higher malware and risk score. Debug logging could expose sensitive information if not properly controlled.

Live on npm for 4 hours and 23 minutes before removal. Socket users were protected even while the package was live.

The code presents a high security risk due to the potential leakage of sensitive system information and insecure network communication. It is crucial to address the lack of error handling and implement secure data handling practices. Malware score: 0.8, Obfuscated score: 0.7, Security risk score: 0.9

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

This code sends an HTTP request to a remote server with sensitive system information, including the hostname, username, and current working directory. This behavior is considered suspicious and potentially malicious. The user should review the purpose of this script and the server receiving the request.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

This script is exfiltrating system information to a remote server without the user's consent. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 35 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior by sending environment variables to an external server. The use of obfuscation techniques and the suspicious domain further raise concerns.

Live on npm for 57 minutes before removal. Socket users were protected even while the package was live.

The script is designed to send sensitive information about the user and the system to an external server, which is a clear indication of malicious behavior.

Live on npm for 7 days, 14 hours and 57 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and exfiltrating sensitive system information to a potentially malicious domain. The use of execSync and insecure HTTPS configuration further increases the security risk.

The primary concern with this code is the use of 'exec' to execute scripts fetched from the internet without validation. This poses a significant security risk as it can potentially execute malicious code. The use of 'os.spawnle' and 'subprocess.Popen' with user-provided inputs also adds to the security concerns. Additionally, there is a typo in 'Optarser' and incomplete handling of the temporary directory cleanup. http://python-distribute.org/distribute_setup.py was marked as Malicious by 1 engine in VT. https://www.virustotal.com/gui/url/3dce83785eafd47d40edd58b58c82593994cd409fc76351033486881fe943c36

The script exhibits clear signs of malicious behavior by collecting and sending sensitive system information to an external server. The use of base64 encoding, while not strong obfuscation, is a technique often used to slightly obscure data. The external server communication poses a significant security risk.

Live on npm for 34 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect and send sensitive information to a remote server without the user's knowledge or consent. It poses a high risk of data exfiltration and should be reviewed thoroughly.

Live on npm for 41 minutes before removal. Socket users were protected even while the package was live.

The code exhibits behavior consistent with data exfiltration by sending environment variables to a suspicious domain. This poses a significant security risk due to potential exposure of sensitive information.

Live on npm for 4 hours and 7 minutes before removal. Socket users were protected even while the package was live.

The code reads sensitive system files including '/etc/passwd' and collects system information such as the home directory, hostname, username, DNS servers, and package details. This data is sent via an HTTPS POST request to a remote server at 'juha9he7uuz32n81la0aui0kqbw2kt8i[.]oastify[.]com' without user consent, posing a significant security risk due to unauthorized data exfiltration.

Live on npm for 1 day, 3 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code sets up a WebSocket proxy server that decrypts incoming messages using a secret key and forwards them to a remote server. However, it has potential security risks such as the use of potentially hard-coded encryption key and the lack of input validation and authentication/authorization checks. It is important to review and enhance the security measures before using this code in a production environment.

Live on npm for 44 days and 49 minutes before removal. Socket users were protected even while the package was live.

Malicious code in es6shsm (npm) Source: ghsa-malware (532e251435e5aa43412f0a3d67927aad3b0df8a7a31d174bc651cda37d917934) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.