Secure your dependencies. Ship with confidence.

The code collects and sends sensitive system information to potentially suspicious external domains without user consent, which is a significant security risk. The use of 'rejectUnauthorized: false' further exacerbates the risk by disabling SSL/TLS certificate validation.

Live on npm for 16 days, 17 hours and 9 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

Live on npm for 1 hour and 15 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive data (the contents of the '/etc/passwd' file) to a remote server. This behavior is highly suspicious and potentially malicious.

The 'preinstall' script collects system information, including hostname, username, current directory, and network configuration, and sends it to a remote server at 0bc6h0p5fxjweey51uk8f1xc339vxmlb[.]oastify[.]com without user consent. This indicates malicious intent to exfiltrate sensitive information.

Live on npm for 3 days, 14 hours and 38 minutes before removal. Socket users were protected even while the package was live.

The script collects information like package details, directories, hostnames, DNS servers and user information, and sends it to a remote server.

Live on npm for 1 hour and 44 minutes before removal. Socket users were protected even while the package was live.

The source code is designed to collect various pieces of system information and send them to a remote server. The code is heavily obfuscated, which is a common tactic to hide malicious behavior. The behavior of collecting and transmitting system data without user consent indicates a high likelihood of malicious intent.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

This script is potentially malicious as it is sending sensitive system information to a remote server without the user's consent. It could be used for data exfiltration or other malicious purposes.

Live on npm for 24 minutes before removal. Socket users were protected even while the package was live.

The code sends sensitive data to an unauthorized or malicious domain using DNS queries, and poses a high security risk. It should be removed immediately from any project.

Live on npm for 29 minutes before removal. Socket users were protected even while the package was live.

The script performs various system-level operations including process killing, network checking, logging, and extensive registry modifications, some of which disable crash reporting and configure system reboots. It also includes an external script for automatic execution. These operations indicate a high potential for misuse or malicious intent, particularly in disabling error reporting and forcing system reboots. Without more context, these actions pose significant security risks.

The code appears to have some suspicious elements such as the use of eval and obfuscated code, raising concerns about potential malicious behavior.

The code appears highly obfuscated with the use of eval() indicating a potential for malicious behavior by executing arbitrary code. The obscured operations and presence of timing functions hint at suspicious activity. Although specific malicious actions are not immediately clear due to the obfuscation, the usage patterns are typical of attempts to conceal harmful operations.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code exhibits behavior typical of malware, such as potential data exfiltration via DNS lookups with encoded system information. This poses a significant security risk.

The source code is performing malicious activities by exfiltrating sensitive system information to a suspicious domain (pingb.in). This poses a significant security risk.

Live on npm for 54 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 55 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive data from the system and send it to a remote server. This is a serious security risk and should be considered malware.

Live on npm for 2 hours and 50 minutes before removal. Socket users were protected even while the package was live.

The code is designed to execute shell commands based on a schedule. While there's no direct evidence of malicious intent, the use of 'shell=True' in subprocess.run poses a significant security risk if untrusted inputs are used. This could potentially be exploited for arbitrary command execution.

Live on pypi for 24 minutes before removal. Socket users were protected even while the package was live.

The script collects information such as package name, directory, home directory, hostname, username, DNS servers, and package.json content, then sends it to a remote server.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates clear signs of malicious behavior, including unauthorized process termination, code injection, and potential data exfiltration via webhooks. The presence of an obfuscated script further suggests attempts to conceal malicious intent. Users should be cautious as this poses a significant security risk.

Live on pypi for 8 hours and 25 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk by downloading and executing a file from an untrusted source without any verification or validation. This could lead to executing malicious software on the user's system.

The code engages in automated package creation and publishing, with the addition of posting content to WordPress sites using hard-coded credentials. This indicates potential spam or automated SEO manipulation behavior. The code also presents significant security risks due to hard-coded paths and credentials.

Live on npm for 30 minutes before removal. Socket users were protected even while the package was live.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

The code sends sensitive data to an unauthorized or malicious domain using DNS queries, and poses a high security risk. It should be removed immediately from any project.

Live on npm for 44 minutes before removal. Socket users were protected even while the package was live.

The code is a utility for running shell commands, which poses a high security risk of command injection if untrusted input is used. There is no direct evidence of malicious intent or obfuscation, but the insecure pattern itself is dangerous.

The code sends the system's hostname to an external domain without user consent, which is a significant security risk. The use of a module named 'mhn-malicious' further raises suspicion of malicious intent.

Live on npm for 2 days, 10 hours and 21 minutes before removal. Socket users were protected even while the package was live.

The code is highly obfuscated and contains elements that suggest potentially malicious behavior, such as executing shell commands and making network requests. Further deobfuscation and analysis are needed to confirm any malicious intent.

Live on npm for 2 days, 3 hours and 30 minutes before removal. Socket users were protected even while the package was live.

The code collects and sends sensitive system information to potentially suspicious external domains without user consent, which is a significant security risk. The use of 'rejectUnauthorized: false' further exacerbates the risk by disabling SSL/TLS certificate validation.

Live on npm for 16 days, 17 hours and 9 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

Live on npm for 1 hour and 15 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive data (the contents of the '/etc/passwd' file) to a remote server. This behavior is highly suspicious and potentially malicious.

The 'preinstall' script collects system information, including hostname, username, current directory, and network configuration, and sends it to a remote server at 0bc6h0p5fxjweey51uk8f1xc339vxmlb[.]oastify[.]com without user consent. This indicates malicious intent to exfiltrate sensitive information.

Live on npm for 3 days, 14 hours and 38 minutes before removal. Socket users were protected even while the package was live.

The script collects information like package details, directories, hostnames, DNS servers and user information, and sends it to a remote server.

Live on npm for 1 hour and 44 minutes before removal. Socket users were protected even while the package was live.

The source code is designed to collect various pieces of system information and send them to a remote server. The code is heavily obfuscated, which is a common tactic to hide malicious behavior. The behavior of collecting and transmitting system data without user consent indicates a high likelihood of malicious intent.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

This script is potentially malicious as it is sending sensitive system information to a remote server without the user's consent. It could be used for data exfiltration or other malicious purposes.

Live on npm for 24 minutes before removal. Socket users were protected even while the package was live.

The code sends sensitive data to an unauthorized or malicious domain using DNS queries, and poses a high security risk. It should be removed immediately from any project.

Live on npm for 29 minutes before removal. Socket users were protected even while the package was live.

The script performs various system-level operations including process killing, network checking, logging, and extensive registry modifications, some of which disable crash reporting and configure system reboots. It also includes an external script for automatic execution. These operations indicate a high potential for misuse or malicious intent, particularly in disabling error reporting and forcing system reboots. Without more context, these actions pose significant security risks.

The code appears to have some suspicious elements such as the use of eval and obfuscated code, raising concerns about potential malicious behavior.

The code appears highly obfuscated with the use of eval() indicating a potential for malicious behavior by executing arbitrary code. The obscured operations and presence of timing functions hint at suspicious activity. Although specific malicious actions are not immediately clear due to the obfuscation, the usage patterns are typical of attempts to conceal harmful operations.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code exhibits behavior typical of malware, such as potential data exfiltration via DNS lookups with encoded system information. This poses a significant security risk.

The source code is performing malicious activities by exfiltrating sensitive system information to a suspicious domain (pingb.in). This poses a significant security risk.

Live on npm for 54 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 55 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive data from the system and send it to a remote server. This is a serious security risk and should be considered malware.

Live on npm for 2 hours and 50 minutes before removal. Socket users were protected even while the package was live.

The code is designed to execute shell commands based on a schedule. While there's no direct evidence of malicious intent, the use of 'shell=True' in subprocess.run poses a significant security risk if untrusted inputs are used. This could potentially be exploited for arbitrary command execution.

Live on pypi for 24 minutes before removal. Socket users were protected even while the package was live.

The script collects information such as package name, directory, home directory, hostname, username, DNS servers, and package.json content, then sends it to a remote server.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates clear signs of malicious behavior, including unauthorized process termination, code injection, and potential data exfiltration via webhooks. The presence of an obfuscated script further suggests attempts to conceal malicious intent. Users should be cautious as this poses a significant security risk.

Live on pypi for 8 hours and 25 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk by downloading and executing a file from an untrusted source without any verification or validation. This could lead to executing malicious software on the user's system.

The code engages in automated package creation and publishing, with the addition of posting content to WordPress sites using hard-coded credentials. This indicates potential spam or automated SEO manipulation behavior. The code also presents significant security risks due to hard-coded paths and credentials.

Live on npm for 30 minutes before removal. Socket users were protected even while the package was live.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

The code sends sensitive data to an unauthorized or malicious domain using DNS queries, and poses a high security risk. It should be removed immediately from any project.

Live on npm for 44 minutes before removal. Socket users were protected even while the package was live.

The code is a utility for running shell commands, which poses a high security risk of command injection if untrusted input is used. There is no direct evidence of malicious intent or obfuscation, but the insecure pattern itself is dangerous.

The code sends the system's hostname to an external domain without user consent, which is a significant security risk. The use of a module named 'mhn-malicious' further raises suspicion of malicious intent.

Live on npm for 2 days, 10 hours and 21 minutes before removal. Socket users were protected even while the package was live.

The code is highly obfuscated and contains elements that suggest potentially malicious behavior, such as executing shell commands and making network requests. Further deobfuscation and analysis are needed to confirm any malicious intent.

Live on npm for 2 days, 3 hours and 30 minutes before removal. Socket users were protected even while the package was live.