Secure your dependencies. Ship with confidence.

t64z bills itself as a Windows-only “Twitter/X auto-uploader” for grey-hat promoters who want to mass-post, like, and follow. On launch it displays a Korean-language Glimmer-DSL-LibUI dialog that requests the operator’s Twitter username and password. The instant those credentials are provided (before any automation starts) the script silently bundles the plaintext username, password, and the host’s MAC address, then POSTs the payload to https://programzon[.]com/auth/program/signin, an endpoint controlled by the zon threat actor. The MAC address supplies a hardware fingerprint, letting the threat actor correlate victims across separate installs and campaigns. Though the gem does proceed with its promised Twitter/X spam workflow, this covert exfiltration makes t64z an infostealer: users chasing aggressive outreach instead surrender their own sensitive credentials to the attacker behind the wider zon malware cluster.

The code is obfuscated and performs potentially malicious actions by sending environment variables to an external domain. This poses a significant security risk due to the potential exposure of sensitive information.

Live on npm for 4 hours and 1 minute before removal. Socket users were protected even while the package was live.

The code demonstrates high-security risk due to hardcoded credentials, MFA bypass mechanisms, and external data exfiltration via Telegram. While possibly intended for controlled automation, the combination of hardcoded secrets, Gmail-based approvals, and automated payments constitutes a substantial misuse risk. Recommend removing hardcoded credentials, securing secrets with env-based or vault management, enforcing MFA with server-side verification, disabling automated Gmail/MFA flows, and eliminating data exfiltration via chat platforms. Overall risk: very high; treat as unacceptable for production without significant remediation.

Best report choice: Report 2 is the most balanced/defensible because it acknowledges the fragment is a composite of snippets while still highlighting the most severe behaviors. Improved assessment: the fragment contains highly suspicious/likely malicious patterns—most notably hardcoded credentials/API keys combined with explicit external exfiltration (fetch to analytics.example.com with secrets in the request body and console logging), plus privilege-escalation via unsafe type assertions and persistence. Additional critical risks are demonstrated (Python pickle deserialization/retraining, possible cross-tenant vector metadata leakage, and unbounded streaming/resource abuse). Because this appears to be a multi-snippet/test corpus rather than a single cohesive module, the malware probability is not maximal, but the security risk is high and warrants investigating the actual package entrypoints and whether these code paths ship/execute.

This module is an explicit network-flooding utility intended to generate continuous UDP traffic toward a target. It is designed to facilitate DDoS-like activity and lacks any safety measures or authorization checks. Treat as malicious/enabling malware: do not run or include as a dependency unless you are performing authorized testing on systems you own and you have corrected and controlled the code. Investigate provenance if found in a dependency tree; remove and audit systems that may have executed it.

This module functions as a global keyboard + clipboard collector that builds a prompt buffer and, upon a hidden suffix trigger, forwards captured keystrokes/clipboard content to an external chat API and types the streamed response into the active application. The behavior strongly aligns with privacy-invasive spyware/infostealing patterns (clipboard harvesting and exfiltration), with additional risk from verbose logging and remote-driven input injection.

The code is designed to scrape URLs from Bing search results for repl[.]it projects, download ZIP files from these URLs, extract their contents, and search for Discord tokens using a regular expression pattern. It then attempts to validate these tokens by making unauthorized requests to Discord's API at discordapp[.]com. This behavior is malicious as it involves collecting sensitive tokens without user consent, potentially leading to unauthorized access or misuse of user accounts.

The code contains some potentially risky functionality, such as the use of `eval_js` and `js_to_rust_buffer`, which could lead to security issues if not properly controlled and monitored. While the code appears to be part of a larger system, the potential security risks should be carefully evaluated and mitigated.

This code fragment contains a high-risk pattern: executing hapirun.py from the current working directory using exec(), which enables arbitrary code execution if an attacker can place or modify that file. Using cwd to discover executable code and configuration (inventory.yml) expands attack surface and is a supply-chain/local compromise vector. The app.discover and app.start calls may further act on untrusted data, but their exact behavior is unknown. Recommend removing exec or restricting execution to trusted, signed files; use package-relative or explicitly-configured safe paths; validate and sandbox inventory input; and avoid executing files from cwd. Treat this module as potentially dangerous until mitigations or the toolbox.app implementation demonstrate safe handling.

Live on pypi for 10 hours and 57 minutes before removal. Socket users were protected even while the package was live.

This code implements an explicit remote-code-execution backdoor: it fetches and executes JavaScript from a hardcoded remote HTTP endpoint using Module._compile, with no integrity, authenticity, or transport protection. Treat this as a severe supply-chain risk. Do not run or install packages containing this snippet. Immediate actions: block/inspect network egress to the listed host, remove the code, or replace with a safe alternative requiring explicit developer action and performing signature/TLS verification. If encountered in a dependency, assume compromise and escalate to incident response.

Attributed by the Socket Threat Research Team to North Korea’s **“Contagious Interview”** operation, this package is a **multi-stage Node.js infostealer/loader** that executes immediately on install, steals **browser credentials**, **crypto-wallet data**, and **macOS keychain** items, enables **clipboard monitoring and keylogging** with **screen capture** (Windows), and **executes commands** via a backdoor. It **downloads and runs BeaverTail** as a secondary payload, **persists and expands** via a Python agent, and **exfiltrates** sensitive data to hardcoded C2 endpoints over HTTP. **C2 Endpoints:** - `hxxp://146[.]70[.]253[.]107:1224/uploads` - `hxxp://146[.]70[.]253[.]107:1224/client` - `hxxp://146[.]70[.]253[.]107:1224/pdown`

Live on npm for 7 days, 9 hours and 5 minutes before removal. Socket users were protected even while the package was live.

This file executes system commands (hostname, pwd, whoami, and curl to ifconfig[.]me) to gather system information and then sends it to an external URL (eoieoosvea6z8ve[.]m[.]pipedream[.]net). Such unauthorized transmission of sensitive system details matches malicious data exfiltration behavior.

The code is involved in data exfiltration by sending sensitive system and project information to external servers without user consent. This behavior is consistent with malicious activity and poses a significant security risk.

Live on npm for 2 hours and 25 minutes before removal. Socket users were protected even while the package was live.

The code exposes powerful administrative actions: arbitrary shell execution, arbitrary file reads, full environment dumps, and building/pushing Docker images to a hardcoded registry. These are not obfuscated but are high-risk capabilities that can be abused for data exfiltration, remote code execution, and supply-chain leakage if the superuser authentication is compromised or misconfigured. The presence of a hardcoded remote image name for docker push is suspicious for unintended outbound artifact exfiltration. Recommendation: avoid including these endpoints in public packages or ensure strict, auditable authentication and input validation; remove hardcoded push targets and avoid returning full environment variables or arbitrary file contents.

This code sends caller-supplied values and potentially header-derived sensitive information to a fixed external URL without validation, consent, or response handling. That pattern constitutes a significant privacy and supply-chain risk (possible covert telemetry or data exfiltration). Recommend: do not use until provenance of the remote endpoint is verified, inspect CustomRequestHeaders implementation, add explicit consent/validation, add timeouts and error handling, and avoid hardcoded external endpoints in library code.

The code implements a reverse shell, which is a severe security threat as it allows unauthorized remote access and command execution on the system. This is indicative of malicious intent.

Live on npm for 8 days, 15 hours and 36 minutes before removal. Socket users were protected even while the package was live.

The script functions as a bootstrap installer that fetches a Teleport binary from a CDN, extracts it, and executes it with user-provided arguments. While common in bootstrap flows, this approach carries significant supply-chain risk due to lack of integrity verification, potential tampering of the CDN content, and execution of an external binary in the host environment. To reduce risk, add cryptographic verification (signatures/checksums), validate the artifact against a trusted manifest, constrain and sanitize teleportArgs, implement isolation (sandbox/container), and improve error handling with cleanup. Consider using pinned TLS/HTTPS, and validating the tarball contents before execution.

The analyzed fragment shows clear indicators of credential harvesting and data exfiltration workflows. It automates browser login flows on an Android device using ADB and Chrome DevTools, navigates Google login UI, potentially captures or changes passwords, and then zips local Chrome/user data and uploads it to a remote endpoint. The presence of remote code fetch/execution path and remote state updates strengthen the impression of a tool designed for credential theft and data exfiltration, with limited benign use-case justification in typical library contexts. This aligns with malware-like behavior suitable for a supply-chain compromise scenario if distributed as part of a package.

This code fragment is a clearly weaponized Struts2 OGNL/Jakarta RCE exploit that performs a marker-based vulnerability probe and then enables an interactive remote command shell by embedding attacker-supplied commands into a malicious HTTP Content-Type OGNL payload. It returns the executed command output to the attacker via the HTTP response body. The behavior is highly dangerous and strongly indicates malicious intent if present in a software supply chain.

This file compresses user data from multiple browser directories, as well as a cryptocurrency wallet, and sends it to a remote server at example[.]com via a base64-encoded webhook. The code deletes local archives immediately after transmission to cover its tracks. Commands are executed silently using PowerShell, illustrating a deliberate effort to steal sensitive data and evade detection.

Live on npm for 13 days, 23 hours and 57 minutes before removal. Socket users were protected even while the package was live.

This code implements a clear reverse shell/backdoor: it connects to a remote host and bridges a local interactive shell to that connection, enabling remote command execution and data exfiltration with no access control or encryption. It is malicious or at minimum extremely dangerous in most contexts and should be treated as a high-risk backdoor. Remove or sandbox it and treat any package containing this code as compromised unless its presence is explicitly required and authorized.

This file implements an unattended update mechanism that fetches and installs .tgz archives from unverified remote sources—both the npm registry (registry[.]npmjs[.]org) and a configurable Firebase-style database URL—by downloading, extracting them into the application directory and then restarting PM2-managed processes. Because there is no cryptographic signature or checksum validation beyond a simple version check, a compromised registry account or database endpoint could deliver arbitrary code to every host running this updater. Additionally, on startup the script gathers extensive system and package metadata—including public IP (via api[.]ipify[.]org), local IP addresses, hostname, OS/platform, Node.js version, CPU/memory statistics, load averages, working directory and package.json fields—and posts it to a configurable Discord webhook endpoint (discordapp[.]com). This behavior poses both a supply-chain risk and a telemetry/privacy exposure risk, as sensitive host information is sent to an external service without explicit user consent or granular control.

t64z bills itself as a Windows-only “Twitter/X auto-uploader” for grey-hat promoters who want to mass-post, like, and follow. On launch it displays a Korean-language Glimmer-DSL-LibUI dialog that requests the operator’s Twitter username and password. The instant those credentials are provided (before any automation starts) the script silently bundles the plaintext username, password, and the host’s MAC address, then POSTs the payload to https://programzon[.]com/auth/program/signin, an endpoint controlled by the zon threat actor. The MAC address supplies a hardware fingerprint, letting the threat actor correlate victims across separate installs and campaigns. Though the gem does proceed with its promised Twitter/X spam workflow, this covert exfiltration makes t64z an infostealer: users chasing aggressive outreach instead surrender their own sensitive credentials to the attacker behind the wider zon malware cluster.

The code is obfuscated and performs potentially malicious actions by sending environment variables to an external domain. This poses a significant security risk due to the potential exposure of sensitive information.

Live on npm for 4 hours and 1 minute before removal. Socket users were protected even while the package was live.

The code demonstrates high-security risk due to hardcoded credentials, MFA bypass mechanisms, and external data exfiltration via Telegram. While possibly intended for controlled automation, the combination of hardcoded secrets, Gmail-based approvals, and automated payments constitutes a substantial misuse risk. Recommend removing hardcoded credentials, securing secrets with env-based or vault management, enforcing MFA with server-side verification, disabling automated Gmail/MFA flows, and eliminating data exfiltration via chat platforms. Overall risk: very high; treat as unacceptable for production without significant remediation.

Best report choice: Report 2 is the most balanced/defensible because it acknowledges the fragment is a composite of snippets while still highlighting the most severe behaviors. Improved assessment: the fragment contains highly suspicious/likely malicious patterns—most notably hardcoded credentials/API keys combined with explicit external exfiltration (fetch to analytics.example.com with secrets in the request body and console logging), plus privilege-escalation via unsafe type assertions and persistence. Additional critical risks are demonstrated (Python pickle deserialization/retraining, possible cross-tenant vector metadata leakage, and unbounded streaming/resource abuse). Because this appears to be a multi-snippet/test corpus rather than a single cohesive module, the malware probability is not maximal, but the security risk is high and warrants investigating the actual package entrypoints and whether these code paths ship/execute.

This module is an explicit network-flooding utility intended to generate continuous UDP traffic toward a target. It is designed to facilitate DDoS-like activity and lacks any safety measures or authorization checks. Treat as malicious/enabling malware: do not run or include as a dependency unless you are performing authorized testing on systems you own and you have corrected and controlled the code. Investigate provenance if found in a dependency tree; remove and audit systems that may have executed it.

This module functions as a global keyboard + clipboard collector that builds a prompt buffer and, upon a hidden suffix trigger, forwards captured keystrokes/clipboard content to an external chat API and types the streamed response into the active application. The behavior strongly aligns with privacy-invasive spyware/infostealing patterns (clipboard harvesting and exfiltration), with additional risk from verbose logging and remote-driven input injection.

The code is designed to scrape URLs from Bing search results for repl[.]it projects, download ZIP files from these URLs, extract their contents, and search for Discord tokens using a regular expression pattern. It then attempts to validate these tokens by making unauthorized requests to Discord's API at discordapp[.]com. This behavior is malicious as it involves collecting sensitive tokens without user consent, potentially leading to unauthorized access or misuse of user accounts.

The code contains some potentially risky functionality, such as the use of `eval_js` and `js_to_rust_buffer`, which could lead to security issues if not properly controlled and monitored. While the code appears to be part of a larger system, the potential security risks should be carefully evaluated and mitigated.

This code fragment contains a high-risk pattern: executing hapirun.py from the current working directory using exec(), which enables arbitrary code execution if an attacker can place or modify that file. Using cwd to discover executable code and configuration (inventory.yml) expands attack surface and is a supply-chain/local compromise vector. The app.discover and app.start calls may further act on untrusted data, but their exact behavior is unknown. Recommend removing exec or restricting execution to trusted, signed files; use package-relative or explicitly-configured safe paths; validate and sandbox inventory input; and avoid executing files from cwd. Treat this module as potentially dangerous until mitigations or the toolbox.app implementation demonstrate safe handling.

Live on pypi for 10 hours and 57 minutes before removal. Socket users were protected even while the package was live.

This code implements an explicit remote-code-execution backdoor: it fetches and executes JavaScript from a hardcoded remote HTTP endpoint using Module._compile, with no integrity, authenticity, or transport protection. Treat this as a severe supply-chain risk. Do not run or install packages containing this snippet. Immediate actions: block/inspect network egress to the listed host, remove the code, or replace with a safe alternative requiring explicit developer action and performing signature/TLS verification. If encountered in a dependency, assume compromise and escalate to incident response.

Attributed by the Socket Threat Research Team to North Korea’s **“Contagious Interview”** operation, this package is a **multi-stage Node.js infostealer/loader** that executes immediately on install, steals **browser credentials**, **crypto-wallet data**, and **macOS keychain** items, enables **clipboard monitoring and keylogging** with **screen capture** (Windows), and **executes commands** via a backdoor. It **downloads and runs BeaverTail** as a secondary payload, **persists and expands** via a Python agent, and **exfiltrates** sensitive data to hardcoded C2 endpoints over HTTP. **C2 Endpoints:** - `hxxp://146[.]70[.]253[.]107:1224/uploads` - `hxxp://146[.]70[.]253[.]107:1224/client` - `hxxp://146[.]70[.]253[.]107:1224/pdown`

Live on npm for 7 days, 9 hours and 5 minutes before removal. Socket users were protected even while the package was live.

This file executes system commands (hostname, pwd, whoami, and curl to ifconfig[.]me) to gather system information and then sends it to an external URL (eoieoosvea6z8ve[.]m[.]pipedream[.]net). Such unauthorized transmission of sensitive system details matches malicious data exfiltration behavior.

The code is involved in data exfiltration by sending sensitive system and project information to external servers without user consent. This behavior is consistent with malicious activity and poses a significant security risk.

Live on npm for 2 hours and 25 minutes before removal. Socket users were protected even while the package was live.

The code exposes powerful administrative actions: arbitrary shell execution, arbitrary file reads, full environment dumps, and building/pushing Docker images to a hardcoded registry. These are not obfuscated but are high-risk capabilities that can be abused for data exfiltration, remote code execution, and supply-chain leakage if the superuser authentication is compromised or misconfigured. The presence of a hardcoded remote image name for docker push is suspicious for unintended outbound artifact exfiltration. Recommendation: avoid including these endpoints in public packages or ensure strict, auditable authentication and input validation; remove hardcoded push targets and avoid returning full environment variables or arbitrary file contents.

This code sends caller-supplied values and potentially header-derived sensitive information to a fixed external URL without validation, consent, or response handling. That pattern constitutes a significant privacy and supply-chain risk (possible covert telemetry or data exfiltration). Recommend: do not use until provenance of the remote endpoint is verified, inspect CustomRequestHeaders implementation, add explicit consent/validation, add timeouts and error handling, and avoid hardcoded external endpoints in library code.

The code implements a reverse shell, which is a severe security threat as it allows unauthorized remote access and command execution on the system. This is indicative of malicious intent.

Live on npm for 8 days, 15 hours and 36 minutes before removal. Socket users were protected even while the package was live.

The script functions as a bootstrap installer that fetches a Teleport binary from a CDN, extracts it, and executes it with user-provided arguments. While common in bootstrap flows, this approach carries significant supply-chain risk due to lack of integrity verification, potential tampering of the CDN content, and execution of an external binary in the host environment. To reduce risk, add cryptographic verification (signatures/checksums), validate the artifact against a trusted manifest, constrain and sanitize teleportArgs, implement isolation (sandbox/container), and improve error handling with cleanup. Consider using pinned TLS/HTTPS, and validating the tarball contents before execution.

The analyzed fragment shows clear indicators of credential harvesting and data exfiltration workflows. It automates browser login flows on an Android device using ADB and Chrome DevTools, navigates Google login UI, potentially captures or changes passwords, and then zips local Chrome/user data and uploads it to a remote endpoint. The presence of remote code fetch/execution path and remote state updates strengthen the impression of a tool designed for credential theft and data exfiltration, with limited benign use-case justification in typical library contexts. This aligns with malware-like behavior suitable for a supply-chain compromise scenario if distributed as part of a package.

This code fragment is a clearly weaponized Struts2 OGNL/Jakarta RCE exploit that performs a marker-based vulnerability probe and then enables an interactive remote command shell by embedding attacker-supplied commands into a malicious HTTP Content-Type OGNL payload. It returns the executed command output to the attacker via the HTTP response body. The behavior is highly dangerous and strongly indicates malicious intent if present in a software supply chain.

This file compresses user data from multiple browser directories, as well as a cryptocurrency wallet, and sends it to a remote server at example[.]com via a base64-encoded webhook. The code deletes local archives immediately after transmission to cover its tracks. Commands are executed silently using PowerShell, illustrating a deliberate effort to steal sensitive data and evade detection.

Live on npm for 13 days, 23 hours and 57 minutes before removal. Socket users were protected even while the package was live.

This code implements a clear reverse shell/backdoor: it connects to a remote host and bridges a local interactive shell to that connection, enabling remote command execution and data exfiltration with no access control or encryption. It is malicious or at minimum extremely dangerous in most contexts and should be treated as a high-risk backdoor. Remove or sandbox it and treat any package containing this code as compromised unless its presence is explicitly required and authorized.

This file implements an unattended update mechanism that fetches and installs .tgz archives from unverified remote sources—both the npm registry (registry[.]npmjs[.]org) and a configurable Firebase-style database URL—by downloading, extracting them into the application directory and then restarting PM2-managed processes. Because there is no cryptographic signature or checksum validation beyond a simple version check, a compromised registry account or database endpoint could deliver arbitrary code to every host running this updater. Additionally, on startup the script gathers extensive system and package metadata—including public IP (via api[.]ipify[.]org), local IP addresses, hostname, OS/platform, Node.js version, CPU/memory statistics, load averages, working directory and package.json fields—and posts it to a configurable Discord webhook endpoint (discordapp[.]com). This behavior poses both a supply-chain risk and a telemetry/privacy exposure risk, as sensitive host information is sent to an external service without explicit user consent or granular control.