Secure your dependencies. Ship with confidence.

This module contains intentionally obfuscated code that decodes and immediately exec()s a large embedded payload at import time. That pattern enables arbitrary code execution and is highly suspicious for supply-chain compromise (backdoor, downloader, credential exfiltration). Treat the package as potentially malicious: do not import or run it until the embedded payload is decoded and reviewed in a secure, isolated environment. If already deployed/imported, assume compromise and perform incident response (remove, scan, rotate secrets, audit systems).

The code performs unauthorized exfiltration of local file contents to a remote server without user consent or encryption, posing a significant privacy and security risk. While the code is clear and not obfuscated, the hardcoded remote endpoint and silent data upload are highly suspicious and indicative of malicious intent or a supply chain attack vector. Users should be warned and the package flagged for removal or further investigation.

This module exhibits numerous malicious and high-risk supply-chain behaviors: self-modification, writing hardcoded credentials to ~/.pypirc, decrypting and executing payloads from disk, deleting files, uploading packages to PyPI, installing third-party packages on demand, and dynamically importing and executing code based on environment input. These patterns indicate intentional unauthorized actions (sabotage, hidden payload execution, or backdoor-like behavior). The package should be treated as malicious and not trusted. Immediate actions: do not run, inspect any systems where it was executed for persistence or deleted files, and treat any PyPI accounts or credentials referenced as compromised.

This dependency fragment performs high-signal environment-variable poisoning by injecting a credential-bearing GitHub URL (token@ in the URL) and a pinned commit SHA into process.env, then sets global loader helpers (globalThis.require/__filename/__dirname) and delegates core behavior to an imported token/util function with additional side-effect chunks. While the actual network/exfil/execution details are not present in this snippet, the combination of hardcoded credential material, env override, and dynamic loading capability is consistent with malicious or unauthorized authenticated fetching/token usage. The referenced chunk modules should be reviewed to confirm the exact behavior.

WebLogic CORBA/IIOP exploitation framework containing hardcoded exploit payloads for binding/rebinding remote objects and executing remote constructor payloads. The code implements multi-stage attacks including backdoor installation capabilities through serialized Java bytecode injection. Contains embedded hex-encoded payloads targeting WebLogic internal classes (weblogic[.]corba[.]cos[.]naming[.]NamingContextAny) and CORBA naming contexts. Functionality includes remote command execution through getServerLocation method calls and JNDI manipulation attacks. While this is legitimate penetration testing code within a security framework, the presence of ready-to-use exploit payloads and backdoor installation mechanisms represents unusual patterns that security tools should flag for review.

The code is performing malicious activities by collecting and exfiltrating system information to a remote server. This behavior is indicative of malware and poses a significant security risk.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates high-risk behavior typical of dropper/packer-like workflows: encrypted payloads embedded in stubs, base64-wrapped code executed at runtime, and optional packaging into executables. While there are syntax anomalies and incomplete branches that prevent immediate execution, the overall pattern is aligned with covert payload delivery or supply-chain risk. Thorough review of the complete, verified source is required before use; treat as dangerous and isolate until confirmed safe.

The code is likely to be a part of a supply chain attack where it collects and exfiltrates sensitive information to a suspicious external server, which represents a serious security risk and potentially malicious behavior.

Live on npm for 17 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This package executes a local script (index.js) during installation. That behavior is inherently risky because the script can perform arbitrary malicious actions. You must inspect the contents of index.js (and any files it requires or downloads) before installing. Treat this package as potentially malicious until proven safe.

This module contains multiple high-risk patterns: dynamic execution of environment-provided strings (exec on TINYFAN_SOURCE), loading and executing arbitrary files as modules, and generation of executable source from potentially untrusted inputs. The provided source is also corrupted/fragmented in places, showing likely tampering or an attempted concealed payload. Treat this code as malicious or at minimum extremely unsafe for use in environments where untrusted input, environment variables, or filesystem contents can be controlled. It should not be used until sanitized, repaired, and re-audited.

The code collects system information and public IP address, and sends it to a remote server without user consent. This behavior is indicative of potential data exfiltration and poses a privacy risk.

Live on npm for 4 days, 12 hours and 40 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by sending userId data to a hardcoded external IP address over unencrypted HTTP without authentication or user consent. This pattern is indicative of potential data exfiltration or privacy violation, which aligns with malware-like behavior. While the code itself is not obfuscated and does not contain explicit backdoors or credential leaks, the hardcoded external endpoint and silent error handling increase the security risk. Overall, this code should be treated as high risk and potentially malicious.

The fragment implements an invasive modification workflow for the Discord Electron app to load an external entryPoint at startup, effectively enabling a backdoor-like code execution path with potential persistence and privilege escalation. While it may be part of a modding framework, the lack of explicit user consent, verifiable integrity checks, and reversible, auditable processes makes it a high-security risk. Recommend removing or dramatically constraining such behavior, replacing with signed, user-approved patches and non-runtime code injection approaches.

This module is strongly indicative of malicious persistence/launcher behavior on Windows: it drops a hidden VBScript that runs Node with a child flag, then creates and starts a scheduled task using a templated XML customized with the current Windows user identity and local paths. It includes meaningful obfuscation and cleans up temporary artifacts, aligning with supply-chain malware dropper patterns. No exfiltration is visible in this snippet, but the persistence capability makes the security risk high.

The script poses a significant risk due to its potential for data theft, unauthorized access, and other malicious activities.

This code harvests a specific user's .gitconfig, encodes it in base64, and writes it to a local file without user interaction or configuration. That pattern is strongly suspicious for data harvesting. While no direct network exfiltration is present in the snippet, the behavior is a privacy/security risk if included in a distributed package. Remove or restrict this code, make paths configurable and require explicit user consent, and audit for any follow-on components that may exfiltrate the written file.

Live on npm for 4 hours and 43 minutes before removal. Socket users were protected even while the package was live.

This file implements a DSL interpreter that executes external script files and dynamically loads modules. The combination of eval() on script content and requiring manifest-specified modules (which are then invoked with full interpreter context) presents a high security risk: an attacker who can modify Door.json, .du scripts, or local module files can execute arbitrary code in the host process. There is no robust sandboxing, no strong input validation, and only weak ad-hoc regex filtering. The package should be treated as high-risk for supply-chain and local-file tampering scenarios. Mitigations: avoid running this with untrusted inputs, restrict filesystem permissions, validate and sign manifests and scripts, or run the interpreter in a properly isolated environment (Node vm with restricted globals or separate process with least privilege).

Live on npm for 3 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This code is a polymorphic code-generator that builds obfuscated Rust loaders: it uses an environment-sourced key to derive an AES key, decrypts embedded ciphertext and writes the decrypted bytes to a temporary file, and includes deliberate anti-analysis constructs (unsafe null write, heavy junk and dead-branches). That combination matches common dropper/loader behavior used in malware. Even if not immediately executing the payload, it enables stealthy delivery of arbitrary binaries and is high risk for supply-chain abuse. I recommend treating packages that include this generator as suspicious and performing strict review/containment before use.

This module is engineered to locate Telegram session artifacts and auth keys on the host and transmit them to a configured Telegram account. Behavior includes reading local session files, copying to temporary storage, and reliably uploading files or sending credentials via Telegram API with multiple fallback mechanisms. This is high-risk malicious behavior that enables account takeover. Do not execute or include this code in trusted environments; remove it and rotate any exposed credentials (bot token, Telegram sessions) if present.

The code embeds multi-stage payloads using Base64+LZMA, executed at import time, to install a Django AppConfig.ready() hook that enforces a brittle anti-tamper check (len(echart/views.py) == 18337) and then recursively compiles every Python source file to bytecode and deletes the originals. Errors are suppressed, and a remote activation endpoint is present for “pro” gating. This combination of hidden execution, anti-analysis, and destructive file operations constitutes high-risk supply-chain malware.

This code collects system-identifying data (username, hostname, file path), hex-encodes it, constructs a domain under a hardcoded external base ('furb.pw') embedding that data into subdomain labels, and issues an HTTPS GET to that domain — a clear data-exfiltration pattern. The behavior is malicious or at minimum privacy-invasive telemetry sent to an external third party. The package should not be trusted or used without removal of the network exfiltration logic and a full audit.

This module includes a high-risk “Script” loader that can transform externally loaded text (from remote URLs via XHR or from local files/blobs) into executable JavaScript using `new Function(...)`, then runs it via `apply`. This creates a direct untrusted-data-to-arbitrary-code-execution flow in the browser. Additional secondary risks include dynamic worker-code generation and a navigation helper that can open/redirect URLs. While the excerpt does not show explicit credential theft or stealthy exfiltration logic, the presence of runtime code-execution primitives makes the supply-chain security risk high and warrants strict controls (disable/lock script loading, restrict allowed origins/files/extensions, and sandbox or remove the feature).

This module is best characterized as an offensive automation toolkit for credential checking/login attempts, session/token harvesting, and account data extraction across multiple services. Critically, it contains a self-contained mechanism (file2link.convert) that uploads arbitrary local file content to a paste service and generates a Python script that fetches that remote content and executes it via exec(), forming a clear remote-code-execution and payload delivery chain. Treat all returned tokens/cookies/passwords as compromised, and do not use or ship this dependency without removal and containment.

This module contains intentionally obfuscated code that decodes and immediately exec()s a large embedded payload at import time. That pattern enables arbitrary code execution and is highly suspicious for supply-chain compromise (backdoor, downloader, credential exfiltration). Treat the package as potentially malicious: do not import or run it until the embedded payload is decoded and reviewed in a secure, isolated environment. If already deployed/imported, assume compromise and perform incident response (remove, scan, rotate secrets, audit systems).

The code performs unauthorized exfiltration of local file contents to a remote server without user consent or encryption, posing a significant privacy and security risk. While the code is clear and not obfuscated, the hardcoded remote endpoint and silent data upload are highly suspicious and indicative of malicious intent or a supply chain attack vector. Users should be warned and the package flagged for removal or further investigation.

This module exhibits numerous malicious and high-risk supply-chain behaviors: self-modification, writing hardcoded credentials to ~/.pypirc, decrypting and executing payloads from disk, deleting files, uploading packages to PyPI, installing third-party packages on demand, and dynamically importing and executing code based on environment input. These patterns indicate intentional unauthorized actions (sabotage, hidden payload execution, or backdoor-like behavior). The package should be treated as malicious and not trusted. Immediate actions: do not run, inspect any systems where it was executed for persistence or deleted files, and treat any PyPI accounts or credentials referenced as compromised.

This dependency fragment performs high-signal environment-variable poisoning by injecting a credential-bearing GitHub URL (token@ in the URL) and a pinned commit SHA into process.env, then sets global loader helpers (globalThis.require/__filename/__dirname) and delegates core behavior to an imported token/util function with additional side-effect chunks. While the actual network/exfil/execution details are not present in this snippet, the combination of hardcoded credential material, env override, and dynamic loading capability is consistent with malicious or unauthorized authenticated fetching/token usage. The referenced chunk modules should be reviewed to confirm the exact behavior.

WebLogic CORBA/IIOP exploitation framework containing hardcoded exploit payloads for binding/rebinding remote objects and executing remote constructor payloads. The code implements multi-stage attacks including backdoor installation capabilities through serialized Java bytecode injection. Contains embedded hex-encoded payloads targeting WebLogic internal classes (weblogic[.]corba[.]cos[.]naming[.]NamingContextAny) and CORBA naming contexts. Functionality includes remote command execution through getServerLocation method calls and JNDI manipulation attacks. While this is legitimate penetration testing code within a security framework, the presence of ready-to-use exploit payloads and backdoor installation mechanisms represents unusual patterns that security tools should flag for review.

The code is performing malicious activities by collecting and exfiltrating system information to a remote server. This behavior is indicative of malware and poses a significant security risk.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates high-risk behavior typical of dropper/packer-like workflows: encrypted payloads embedded in stubs, base64-wrapped code executed at runtime, and optional packaging into executables. While there are syntax anomalies and incomplete branches that prevent immediate execution, the overall pattern is aligned with covert payload delivery or supply-chain risk. Thorough review of the complete, verified source is required before use; treat as dangerous and isolate until confirmed safe.

The code is likely to be a part of a supply chain attack where it collects and exfiltrates sensitive information to a suspicious external server, which represents a serious security risk and potentially malicious behavior.

Live on npm for 17 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This package executes a local script (index.js) during installation. That behavior is inherently risky because the script can perform arbitrary malicious actions. You must inspect the contents of index.js (and any files it requires or downloads) before installing. Treat this package as potentially malicious until proven safe.

This module contains multiple high-risk patterns: dynamic execution of environment-provided strings (exec on TINYFAN_SOURCE), loading and executing arbitrary files as modules, and generation of executable source from potentially untrusted inputs. The provided source is also corrupted/fragmented in places, showing likely tampering or an attempted concealed payload. Treat this code as malicious or at minimum extremely unsafe for use in environments where untrusted input, environment variables, or filesystem contents can be controlled. It should not be used until sanitized, repaired, and re-audited.

The code collects system information and public IP address, and sends it to a remote server without user consent. This behavior is indicative of potential data exfiltration and poses a privacy risk.

Live on npm for 4 days, 12 hours and 40 minutes before removal. Socket users were protected even while the package was live.

The code exhibits suspicious behavior by sending userId data to a hardcoded external IP address over unencrypted HTTP without authentication or user consent. This pattern is indicative of potential data exfiltration or privacy violation, which aligns with malware-like behavior. While the code itself is not obfuscated and does not contain explicit backdoors or credential leaks, the hardcoded external endpoint and silent error handling increase the security risk. Overall, this code should be treated as high risk and potentially malicious.

The fragment implements an invasive modification workflow for the Discord Electron app to load an external entryPoint at startup, effectively enabling a backdoor-like code execution path with potential persistence and privilege escalation. While it may be part of a modding framework, the lack of explicit user consent, verifiable integrity checks, and reversible, auditable processes makes it a high-security risk. Recommend removing or dramatically constraining such behavior, replacing with signed, user-approved patches and non-runtime code injection approaches.

This module is strongly indicative of malicious persistence/launcher behavior on Windows: it drops a hidden VBScript that runs Node with a child flag, then creates and starts a scheduled task using a templated XML customized with the current Windows user identity and local paths. It includes meaningful obfuscation and cleans up temporary artifacts, aligning with supply-chain malware dropper patterns. No exfiltration is visible in this snippet, but the persistence capability makes the security risk high.

The script poses a significant risk due to its potential for data theft, unauthorized access, and other malicious activities.

This code harvests a specific user's .gitconfig, encodes it in base64, and writes it to a local file without user interaction or configuration. That pattern is strongly suspicious for data harvesting. While no direct network exfiltration is present in the snippet, the behavior is a privacy/security risk if included in a distributed package. Remove or restrict this code, make paths configurable and require explicit user consent, and audit for any follow-on components that may exfiltrate the written file.

Live on npm for 4 hours and 43 minutes before removal. Socket users were protected even while the package was live.

This file implements a DSL interpreter that executes external script files and dynamically loads modules. The combination of eval() on script content and requiring manifest-specified modules (which are then invoked with full interpreter context) presents a high security risk: an attacker who can modify Door.json, .du scripts, or local module files can execute arbitrary code in the host process. There is no robust sandboxing, no strong input validation, and only weak ad-hoc regex filtering. The package should be treated as high-risk for supply-chain and local-file tampering scenarios. Mitigations: avoid running this with untrusted inputs, restrict filesystem permissions, validate and sign manifests and scripts, or run the interpreter in a properly isolated environment (Node vm with restricted globals or separate process with least privilege).

Live on npm for 3 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This code is a polymorphic code-generator that builds obfuscated Rust loaders: it uses an environment-sourced key to derive an AES key, decrypts embedded ciphertext and writes the decrypted bytes to a temporary file, and includes deliberate anti-analysis constructs (unsafe null write, heavy junk and dead-branches). That combination matches common dropper/loader behavior used in malware. Even if not immediately executing the payload, it enables stealthy delivery of arbitrary binaries and is high risk for supply-chain abuse. I recommend treating packages that include this generator as suspicious and performing strict review/containment before use.

This module is engineered to locate Telegram session artifacts and auth keys on the host and transmit them to a configured Telegram account. Behavior includes reading local session files, copying to temporary storage, and reliably uploading files or sending credentials via Telegram API with multiple fallback mechanisms. This is high-risk malicious behavior that enables account takeover. Do not execute or include this code in trusted environments; remove it and rotate any exposed credentials (bot token, Telegram sessions) if present.

The code embeds multi-stage payloads using Base64+LZMA, executed at import time, to install a Django AppConfig.ready() hook that enforces a brittle anti-tamper check (len(echart/views.py) == 18337) and then recursively compiles every Python source file to bytecode and deletes the originals. Errors are suppressed, and a remote activation endpoint is present for “pro” gating. This combination of hidden execution, anti-analysis, and destructive file operations constitutes high-risk supply-chain malware.

This code collects system-identifying data (username, hostname, file path), hex-encodes it, constructs a domain under a hardcoded external base ('furb.pw') embedding that data into subdomain labels, and issues an HTTPS GET to that domain — a clear data-exfiltration pattern. The behavior is malicious or at minimum privacy-invasive telemetry sent to an external third party. The package should not be trusted or used without removal of the network exfiltration logic and a full audit.

This module includes a high-risk “Script” loader that can transform externally loaded text (from remote URLs via XHR or from local files/blobs) into executable JavaScript using `new Function(...)`, then runs it via `apply`. This creates a direct untrusted-data-to-arbitrary-code-execution flow in the browser. Additional secondary risks include dynamic worker-code generation and a navigation helper that can open/redirect URLs. While the excerpt does not show explicit credential theft or stealthy exfiltration logic, the presence of runtime code-execution primitives makes the supply-chain security risk high and warrants strict controls (disable/lock script loading, restrict allowed origins/files/extensions, and sandbox or remove the feature).

This module is best characterized as an offensive automation toolkit for credential checking/login attempts, session/token harvesting, and account data extraction across multiple services. Critically, it contains a self-contained mechanism (file2link.convert) that uploads arbitrary local file content to a paste service and generates a Python script that fetches that remote content and executes it via exec(), forming a clear remote-code-execution and payload delivery chain. Treat all returned tokens/cookies/passwords as compromised, and do not use or ship this dependency without removal and containment.