Secure your dependencies. Ship with confidence.

Malicious code in body-string (npm) Source: ghsa-malware (024810ffdef1542f8c45378c3e352768e1e0d45658e37838e186cf40cfeb18f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 10 hours and 17 minutes before removal. Socket users were protected even while the package was live.

Malicious code in mxuaubyyc (npm) Source: ghsa-malware (9bc5d76d1ee0309321a96e4d619dded11684cc26cd16109ae8163bb183c24c70) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in gemnasium-gitlab-service (RubyGems)

Malicious code in sport-components (npm) Source: ghsa-malware (b2481fe779e2416d142e05466c10960f525f156396ee4453691f407046fd52b9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Previously contained malicious code that was removed by the registry’s security team. The placeholder content indicates that the package had been compromised and could have executed harmful actions before removal, reflecting a high level of risk to users at the time. No active malicious domains or IP addresses remain in the current placeholder.

Malicious code in azure-ai-text-analytics-js (npm) Source: ghsa-malware (88b2db08b01c8ea8b5bf42651328827362002fa84b2b94fe677afcdd0a29b637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 6 hours and 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in skfb-viewer-protocol (npm) Source: ghsa-malware (4927fb8f7bd066a5440285ee318f12ff607b41497351c980b56408dd0b35f244) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 36 minutes before removal. Socket users were protected even while the package was live.

Malicious code in thisisnothelloworld (npm) Source: ghsa-malware (cd3ab2c96415cc2ceebd811812f343bf5295bb2dadbfccd4ff65f800b1d2d0bd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in kdghyalusmjenvpw (npm) Source: ghsa-malware (7abeb39b30782b75abd80ee4d2c4095b1a7f92ef6928a497a9274bdb1997a675) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in flipper-plugin-core (npm) Source: ghsa-malware (0d0ce77de29c719770f78a2ed8c4c02eef1838754428ba47fa797d900c8fe2a0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The script collects information like environment variables, hostname, user info and current working directory and sends it to a remote server.

Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.

This script embeds hardcoded Firebase credentials, gathers system UUID and user account details without clear consent, and warns of a self-deletion mechanism if a specific 'activation' process fails. It also downloads and executes additional code from external sources (e.g., example[.]com/firebase/storage) without validation, raising the risk of malicious remote code execution. These behaviors suggest intent to control or coerce users and pose a high risk of misuse for data collection and unauthorized access.

Malicious code in ardoq-sheet-load (npm) Source: ghsa-malware (95ffe4a6b987be146cd7315473d74b684d40acd0755edcb6f2f6f08398473ad2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours before removal. Socket users were protected even while the package was live.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in paysafe-ia-v1-portal-backoffice-fe (npm) Source: ghsa-malware (d850f2bbe367e21f3680c1838be9099246287331edec3c167b8af3fd5bba350f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Source: ossf-package-analysis (81695c222f8f689999c72ad01556ee444fb116c56f2124235940349b34be8eca) The OpenSSF Package Analysis project identified 'paysafe-ia-v1-portal-backoffice-fe' @ 5.0.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code is dangerous and should be updated to use asynchronous HTTP requests and enable TLS/SSL certificate verification. The hardcoded URL and directory path should also be removed or made configurable.

Live on npm for 3 days, 17 hours and 16 minutes before removal. Socket users were protected even while the package was live.

This script lists the root directory and saves it to a file named 'result.txt'. This behavior is considered suspicious and potentially malicious.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code is malicious as it sends environment variables, which may contain sensitive information, to an external server without consent. The code is also heavily obfuscated, which raises further suspicion.

Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in fxa-dev-launcher (npm) Source: ghsa-malware (98ed0ac9d7db600b89a3182d2eb21eaa58280411b41ac01a569dab47f4963351) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code exhibits behavior consistent with data exfiltration, sending sensitive system and project information to external servers without user consent. This poses a significant security risk and suggests potential malicious intent.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

Malicious code in httpinfrastructure (npm) Source: ghsa-malware (34c25bae800f5d8e992b1fbda3daf30b45b483169d38d39cd5f87d0d3be3953c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 57 minutes before removal. Socket users were protected even while the package was live.

The script is engaging in potentially malicious activities by collecting sensitive information and sending it to suspicious external domains. This poses a significant security risk and should be addressed immediately.

Malicious code in body-string (npm) Source: ghsa-malware (024810ffdef1542f8c45378c3e352768e1e0d45658e37838e186cf40cfeb18f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 10 hours and 17 minutes before removal. Socket users were protected even while the package was live.

Malicious code in mxuaubyyc (npm) Source: ghsa-malware (9bc5d76d1ee0309321a96e4d619dded11684cc26cd16109ae8163bb183c24c70) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in gemnasium-gitlab-service (RubyGems)

Malicious code in sport-components (npm) Source: ghsa-malware (b2481fe779e2416d142e05466c10960f525f156396ee4453691f407046fd52b9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Previously contained malicious code that was removed by the registry’s security team. The placeholder content indicates that the package had been compromised and could have executed harmful actions before removal, reflecting a high level of risk to users at the time. No active malicious domains or IP addresses remain in the current placeholder.

Malicious code in azure-ai-text-analytics-js (npm) Source: ghsa-malware (88b2db08b01c8ea8b5bf42651328827362002fa84b2b94fe677afcdd0a29b637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 6 hours and 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in skfb-viewer-protocol (npm) Source: ghsa-malware (4927fb8f7bd066a5440285ee318f12ff607b41497351c980b56408dd0b35f244) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 36 minutes before removal. Socket users were protected even while the package was live.

Malicious code in thisisnothelloworld (npm) Source: ghsa-malware (cd3ab2c96415cc2ceebd811812f343bf5295bb2dadbfccd4ff65f800b1d2d0bd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in kdghyalusmjenvpw (npm) Source: ghsa-malware (7abeb39b30782b75abd80ee4d2c4095b1a7f92ef6928a497a9274bdb1997a675) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in flipper-plugin-core (npm) Source: ghsa-malware (0d0ce77de29c719770f78a2ed8c4c02eef1838754428ba47fa797d900c8fe2a0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The script collects information like environment variables, hostname, user info and current working directory and sends it to a remote server.

Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.

This script embeds hardcoded Firebase credentials, gathers system UUID and user account details without clear consent, and warns of a self-deletion mechanism if a specific 'activation' process fails. It also downloads and executes additional code from external sources (e.g., example[.]com/firebase/storage) without validation, raising the risk of malicious remote code execution. These behaviors suggest intent to control or coerce users and pose a high risk of misuse for data collection and unauthorized access.

Malicious code in ardoq-sheet-load (npm) Source: ghsa-malware (95ffe4a6b987be146cd7315473d74b684d40acd0755edcb6f2f6f08398473ad2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours before removal. Socket users were protected even while the package was live.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in paysafe-ia-v1-portal-backoffice-fe (npm) Source: ghsa-malware (d850f2bbe367e21f3680c1838be9099246287331edec3c167b8af3fd5bba350f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Source: ossf-package-analysis (81695c222f8f689999c72ad01556ee444fb116c56f2124235940349b34be8eca) The OpenSSF Package Analysis project identified 'paysafe-ia-v1-portal-backoffice-fe' @ 5.0.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code is dangerous and should be updated to use asynchronous HTTP requests and enable TLS/SSL certificate verification. The hardcoded URL and directory path should also be removed or made configurable.

Live on npm for 3 days, 17 hours and 16 minutes before removal. Socket users were protected even while the package was live.

This script lists the root directory and saves it to a file named 'result.txt'. This behavior is considered suspicious and potentially malicious.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code is malicious as it sends environment variables, which may contain sensitive information, to an external server without consent. The code is also heavily obfuscated, which raises further suspicion.

Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in fxa-dev-launcher (npm) Source: ghsa-malware (98ed0ac9d7db600b89a3182d2eb21eaa58280411b41ac01a569dab47f4963351) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code exhibits behavior consistent with data exfiltration, sending sensitive system and project information to external servers without user consent. This poses a significant security risk and suggests potential malicious intent.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

Malicious code in httpinfrastructure (npm) Source: ghsa-malware (34c25bae800f5d8e992b1fbda3daf30b45b483169d38d39cd5f87d0d3be3953c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 57 minutes before removal. Socket users were protected even while the package was live.

The script is engaging in potentially malicious activities by collecting sensitive information and sending it to suspicious external domains. This poses a significant security risk and should be addressed immediately.