Secure your dependencies. Ship with confidence.

High security risk. This fragment implements server-driven remote code execution in the browser (window.eval and new Function driven by server-provided commands/scripts), and it also injects server-rendered HTML via innerHTML as well as server-supplied CSS. Cross-origin messaging uses wildcard targets ('*'), further expanding attack surface. Even if intended as “remote UI scripting,” the capability set is sufficiently dangerous that it should be treated as potentially malicious and gated/locked down (disable remote eval, enforce strict sanitization for HTML, enforce origin checks for postMessage, and strongly authenticate/authorize server command sources).

The script executes a CommonJS module with a potentially random or obfuscated name, which is often a red flag for malicious behavior. The safety of this script cannot be determined without inspecting the contents of '8ht7w4vr.cjs'.

The analyzed code is heavily obfuscated and uses dynamic code execution and extensive file system access to scan and read user files. While no explicit malicious payload such as network exfiltration or reverse shell is visible, the suspicious patterns and obfuscation strongly indicate potential malware or spyware behavior. The code poses a moderate to high security risk, especially if run in sensitive environments. Users should avoid using this code without thorough vetting and dynamic analysis. The malware probability is moderate given the suspicious constructs, but not conclusively malicious without further evidence.

Live on npm for 6 hours and 33 minutes before removal. Socket users were protected even while the package was live.

The code fragment exhibits high-risk behavior suitable for supply chain abuse: it clones arbitrary repositories, deletes git history to obscure provenance, and may launch a code editor in the cloned directory, potentially executing repository hooks or payloads. The hardcoded external URL further suggests guidance or payload delivery mechanisms. This pattern is dangerous for typical npm usage and warrants treating the package as suspicious, with strict input whitelisting, restricted command execution, and provenance verification before any adoption. Recommend eliminating dynamic shell execution paths, avoiding automatic repo cloning during installation, and sandboxing any repository operations with explicit user consent and validation.

This code collects system-identifying data (username, hostname, file path), hex-encodes it, constructs a domain under a hardcoded external base ('furb.pw') embedding that data into subdomain labels, and issues an HTTPS GET to that domain — a clear data-exfiltration pattern. The behavior is malicious or at minimum privacy-invasive telemetry sent to an external third party. The package should not be trusted or used without removal of the network exfiltration logic and a full audit.

The fragment contains a high-risk pattern: it downloads a Python script from a remote source and immediately executes it without integrity verification or sandboxing. This creates a critical supply-chain and remote-code-execution risk, as the remote payload could perform any action on the host, including data exfiltration, credential access, or system compromise. Even though defaults use placeholders, the mechanism itself is unsafe and should be disallowed or hardened (e.g., verify hashes, use signed modules, avoid executing remote code).

The code contains potential security risks due to the construction of headers and body based on various input sources, as well as the usage of 'fetch' for making the API request. The dynamic nature of the header construction and the handling of untrusted input increase the likelihood of security vulnerabilities. The code should be further reviewed and potentially refactored to ensure the secure handling of input and API requests.

Live on npm for 6 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code exhibits clear malicious behavior, including data exfiltration via a Discord webhook, unauthorized code injection into Discord files, and manipulation of system processes. These actions pose a significant security risk to users.

Live on npm for 1 hour and 26 minutes before removal. Socket users were protected even while the package was live.

The code implements a high-risk dynamic evaluation pattern by evaluating tokens within the caller’s scope. This creates a strong possibility of arbitrary code execution and data leakage if tokens originate from untrusted inputs. Hardening should include removing eval, replacing with safe resolvers, sandboxing, or strict token whitelisting and restricting scope access. This pattern is unsuitable for trusted libraries exposes in open-source supply chains without significant safeguards.

This script is a utility to synchronise git dependencies according to a DEPS file. The primary security concern is the use of exec() on the DEPS file contents which allows arbitrary code execution from that file, combined with unvalidated git clone/fetch operations that will contact network hosts and write files locally. There is no evidence inside this file of an explicit backdoor or obfuscated malware, but the exec() pattern and automatic cloning of arbitrary repositories constitutes a significant supply-chain and code-execution risk. Treat DEPS files and repository sources as fully trusted inputs; do not run this script on untrusted DEPS or in privileged environments without review.

This code is a clear malicious reverse shell/backdoor. It establishes an outbound TCP connection to a hard-coded remote host and exposes an interactive system shell to that host, allowing unfettered remote command execution and data exfiltration. It should be treated as high-risk malware and removed or blocked immediately; affected systems should be considered compromised and subject to incident response.

This module sends user credentials and job data to hardcoded external HTTP endpoints (IP address 54.211.133.186) using plain HTTP, which exposes credentials and data to interception and makes exfiltration trivial if the endpoints are malicious. The hardcoded IP and unusual path names are suspicious. The code lacks TLS and proper configuration, and prints server responses without redaction. Recommendation: treat this package as untrusted until the remote endpoints and their owners are verified; remove or sandbox usage and avoid entering real credentials. The final except block has a typographical bug ('Non') that would cause runtime errors and suggests the file may be tampered with or truncated.

This module is best characterized as a script compilation-and-execution runtime with multiple direct arbitrary code execution sinks (browser <script> injection, Node vm.Script/runInThisContext, and core.eval on both files and interactive stdin). It also allows dynamic module loading and includes persistence and data-transfer capable helpers. In a software supply-chain context, the presence of these execution primitives makes it extremely risky unless the dependency is fully trusted and all script/file/module/command inputs are strictly controlled and sandboxed by the application.

The provided code fragment is highly obfuscated and exhibits suspicious and potentially malicious behavior. It should be considered a significant security risk.

Live on npm for 29 days, 17 hours and 16 minutes before removal. Socket users were protected even while the package was live.

The code contains significant security risks, primarily due to the use of eval and exec, which can lead to arbitrary code execution. The handling of cookies also poses a risk if not properly validated. Overall, the code should be reviewed and modified to mitigate these vulnerabilities.

Live on pypi for 207 days, 19 hours and 17 minutes before removal. Socket users were protected even while the package was live.

This code implements a Google Ads assets search handler that functions as intended but contains security concerns: construction of GAQL queries via unsanitized string concatenation using user-supplied parameters (searchTerm, limit, assetType) creates a GAQL-injection-like risk and could lead to unexpected queries or errors. The heavy string/identifier obfuscation complicates review and should be removed or deobfuscated for clearer auditing. Avoid exposing raw error.message in thrown errors. No direct evidence of malware in this fragment, but the obfuscation and unsafe query construction warrant code hardening and full-package review.

Live on npm for 11 hours before removal. Socket users were protected even while the package was live.

The analyzed fragment demonstrates a high-risk runtime code-loading pattern: an embedded encrypted payload is decrypted at load time and used to inject external code, in addition to publicly exposed Firebase config and extensive telemetry/config flows. While legitimate analytics and charting components may be present, the dynamic loader constitutes a significant supply-chain and runtime risk, capable of introducing a backdoor or dropper under attacker-controlled payloads. This should be treated as malware-like risk pending maintainers’ clarification. Recommended actions include removing or hardening the runtime decrypt/load path (use signed, integrity-checked modules), relocating sensitive keys/config to secure servers, and introducing strict CSP and integrity checks for any externally loaded scripts. Consider isolating this loader behind feature flags or removing it entirely for production builds.

The code is vulnerable to command injection and can be exploited by an attacker to run malicious commands on the system. It poses a high security risk and should be revised to include proper input validation and sanitization.

Live on npm for 18 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an untrusted external server without user consent. This poses a significant security risk.

Live on npm for 9 hours and 47 minutes before removal. Socket users were protected even while the package was live.

This module collects extensive system and CI/CD environment metadata—including hostname, platform, architecture, Node version, current working directory, username, home-directory contents, network interfaces, filtered environment variables related to CI (Azure, GitHub Actions, GitLab CI, Jenkins, CircleCI, Travis), filesystem probes (workspace paths, directory listings, parent directories), and a SHA-256 fingerprint of host/run identifiers. It immediately sends this data in two parts via HTTPS GET requests to a hardcoded webhook URL: https://webhook[.]site/0df1aac5-4383-4eb7-88a8-293905b74fd6?data=<payload>. After 500 ms it repeats with a second payload. Finally, it performs dns.resolve('1emg6uz88a7kz7jpuq3lqybhg[.]canarytokens[.]com') to beacon execution back to a canarytokens service. Such covert exfiltration and out-of-band beaconing represent malicious reconnaissance/backdoor activity and pose a high security risk.

This source file is the central orchestration for a remote implant/C2 client (Sliver). It collects and transmits detailed host-identifying information, accepts and executes arbitrary tasks from a remote operator, supports runtime reconfiguration (server-supplied C2 addresses), and exposes multiple stealthy execution vectors (DLL exports, service, shellcode). In typical software supply-chain or production contexts this component is malicious and should not be included or executed. Further review of transports, handlers, and pivots modules is required to enumerate C2 endpoints, payload behaviors, and full exploitation capabilities.

This file is a covert/automatic cryptocurrency miner: it connects to a remote mining pool, authorizes with a hardcoded wallet address, receives jobs, computes yespower hashes, and submits valid shares to credit that wallet. In the context of a general-purpose dependency this is malicious (cryptominer/supply-chain abuse). If found bundled in unrelated software, treat as malicious, remove and audit the package and systems where it ran. If part of a documented mining client, behavior is functional but still contains hardcoded credentials and minimal error handling—both poor security practices.

Live on npm for 3 hours and 40 minutes before removal. Socket users were protected even while the package was live.

This extension performs immediate, silent collection of host/user environment data via shell commands and transmits that data to a hardcoded remote server. Behavior matches data exfiltration/telemetry without consent. Given the context (editor extension running with user privileges), this is privacy-invasive and likely malicious for a publicly distributed extension. Recommend treating the package as unsafe: do not install in trusted environments, remove from supply chains, and investigate other files/versions for additional functionality or commands.

Live on openvsx for 8 days, 3 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The code offers convenient completion helpers but contains a high-risk pattern: using eval() on a substring derived from a user-controlled completion string with an attacker-controlled or broad globals mapping. This enables arbitrary code execution and information disclosure of objects available in 'globs'. The fragment is not evidently malicious or obfuscated, but it represents a moderate-to-high security risk in any context where 's' or 'globs' can be influenced by untrusted parties. Recommend removing eval and implementing a safe dotted-name resolution and tightening what globals are exposed.

Live on pypi for 10 hours and 50 minutes before removal. Socket users were protected even while the package was live.

High security risk. This fragment implements server-driven remote code execution in the browser (window.eval and new Function driven by server-provided commands/scripts), and it also injects server-rendered HTML via innerHTML as well as server-supplied CSS. Cross-origin messaging uses wildcard targets ('*'), further expanding attack surface. Even if intended as “remote UI scripting,” the capability set is sufficiently dangerous that it should be treated as potentially malicious and gated/locked down (disable remote eval, enforce strict sanitization for HTML, enforce origin checks for postMessage, and strongly authenticate/authorize server command sources).

The script executes a CommonJS module with a potentially random or obfuscated name, which is often a red flag for malicious behavior. The safety of this script cannot be determined without inspecting the contents of '8ht7w4vr.cjs'.

The analyzed code is heavily obfuscated and uses dynamic code execution and extensive file system access to scan and read user files. While no explicit malicious payload such as network exfiltration or reverse shell is visible, the suspicious patterns and obfuscation strongly indicate potential malware or spyware behavior. The code poses a moderate to high security risk, especially if run in sensitive environments. Users should avoid using this code without thorough vetting and dynamic analysis. The malware probability is moderate given the suspicious constructs, but not conclusively malicious without further evidence.

Live on npm for 6 hours and 33 minutes before removal. Socket users were protected even while the package was live.

The code fragment exhibits high-risk behavior suitable for supply chain abuse: it clones arbitrary repositories, deletes git history to obscure provenance, and may launch a code editor in the cloned directory, potentially executing repository hooks or payloads. The hardcoded external URL further suggests guidance or payload delivery mechanisms. This pattern is dangerous for typical npm usage and warrants treating the package as suspicious, with strict input whitelisting, restricted command execution, and provenance verification before any adoption. Recommend eliminating dynamic shell execution paths, avoiding automatic repo cloning during installation, and sandboxing any repository operations with explicit user consent and validation.

This code collects system-identifying data (username, hostname, file path), hex-encodes it, constructs a domain under a hardcoded external base ('furb.pw') embedding that data into subdomain labels, and issues an HTTPS GET to that domain — a clear data-exfiltration pattern. The behavior is malicious or at minimum privacy-invasive telemetry sent to an external third party. The package should not be trusted or used without removal of the network exfiltration logic and a full audit.

The fragment contains a high-risk pattern: it downloads a Python script from a remote source and immediately executes it without integrity verification or sandboxing. This creates a critical supply-chain and remote-code-execution risk, as the remote payload could perform any action on the host, including data exfiltration, credential access, or system compromise. Even though defaults use placeholders, the mechanism itself is unsafe and should be disallowed or hardened (e.g., verify hashes, use signed modules, avoid executing remote code).

The code contains potential security risks due to the construction of headers and body based on various input sources, as well as the usage of 'fetch' for making the API request. The dynamic nature of the header construction and the handling of untrusted input increase the likelihood of security vulnerabilities. The code should be further reviewed and potentially refactored to ensure the secure handling of input and API requests.

Live on npm for 6 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code exhibits clear malicious behavior, including data exfiltration via a Discord webhook, unauthorized code injection into Discord files, and manipulation of system processes. These actions pose a significant security risk to users.

Live on npm for 1 hour and 26 minutes before removal. Socket users were protected even while the package was live.

The code implements a high-risk dynamic evaluation pattern by evaluating tokens within the caller’s scope. This creates a strong possibility of arbitrary code execution and data leakage if tokens originate from untrusted inputs. Hardening should include removing eval, replacing with safe resolvers, sandboxing, or strict token whitelisting and restricting scope access. This pattern is unsuitable for trusted libraries exposes in open-source supply chains without significant safeguards.

This script is a utility to synchronise git dependencies according to a DEPS file. The primary security concern is the use of exec() on the DEPS file contents which allows arbitrary code execution from that file, combined with unvalidated git clone/fetch operations that will contact network hosts and write files locally. There is no evidence inside this file of an explicit backdoor or obfuscated malware, but the exec() pattern and automatic cloning of arbitrary repositories constitutes a significant supply-chain and code-execution risk. Treat DEPS files and repository sources as fully trusted inputs; do not run this script on untrusted DEPS or in privileged environments without review.

This code is a clear malicious reverse shell/backdoor. It establishes an outbound TCP connection to a hard-coded remote host and exposes an interactive system shell to that host, allowing unfettered remote command execution and data exfiltration. It should be treated as high-risk malware and removed or blocked immediately; affected systems should be considered compromised and subject to incident response.

This module sends user credentials and job data to hardcoded external HTTP endpoints (IP address 54.211.133.186) using plain HTTP, which exposes credentials and data to interception and makes exfiltration trivial if the endpoints are malicious. The hardcoded IP and unusual path names are suspicious. The code lacks TLS and proper configuration, and prints server responses without redaction. Recommendation: treat this package as untrusted until the remote endpoints and their owners are verified; remove or sandbox usage and avoid entering real credentials. The final except block has a typographical bug ('Non') that would cause runtime errors and suggests the file may be tampered with or truncated.

This module is best characterized as a script compilation-and-execution runtime with multiple direct arbitrary code execution sinks (browser <script> injection, Node vm.Script/runInThisContext, and core.eval on both files and interactive stdin). It also allows dynamic module loading and includes persistence and data-transfer capable helpers. In a software supply-chain context, the presence of these execution primitives makes it extremely risky unless the dependency is fully trusted and all script/file/module/command inputs are strictly controlled and sandboxed by the application.

The provided code fragment is highly obfuscated and exhibits suspicious and potentially malicious behavior. It should be considered a significant security risk.

Live on npm for 29 days, 17 hours and 16 minutes before removal. Socket users were protected even while the package was live.

The code contains significant security risks, primarily due to the use of eval and exec, which can lead to arbitrary code execution. The handling of cookies also poses a risk if not properly validated. Overall, the code should be reviewed and modified to mitigate these vulnerabilities.

Live on pypi for 207 days, 19 hours and 17 minutes before removal. Socket users were protected even while the package was live.

This code implements a Google Ads assets search handler that functions as intended but contains security concerns: construction of GAQL queries via unsanitized string concatenation using user-supplied parameters (searchTerm, limit, assetType) creates a GAQL-injection-like risk and could lead to unexpected queries or errors. The heavy string/identifier obfuscation complicates review and should be removed or deobfuscated for clearer auditing. Avoid exposing raw error.message in thrown errors. No direct evidence of malware in this fragment, but the obfuscation and unsafe query construction warrant code hardening and full-package review.

Live on npm for 11 hours before removal. Socket users were protected even while the package was live.

The analyzed fragment demonstrates a high-risk runtime code-loading pattern: an embedded encrypted payload is decrypted at load time and used to inject external code, in addition to publicly exposed Firebase config and extensive telemetry/config flows. While legitimate analytics and charting components may be present, the dynamic loader constitutes a significant supply-chain and runtime risk, capable of introducing a backdoor or dropper under attacker-controlled payloads. This should be treated as malware-like risk pending maintainers’ clarification. Recommended actions include removing or hardening the runtime decrypt/load path (use signed, integrity-checked modules), relocating sensitive keys/config to secure servers, and introducing strict CSP and integrity checks for any externally loaded scripts. Consider isolating this loader behind feature flags or removing it entirely for production builds.

The code is vulnerable to command injection and can be exploited by an attacker to run malicious commands on the system. It poses a high security risk and should be revised to include proper input validation and sanitization.

Live on npm for 18 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an untrusted external server without user consent. This poses a significant security risk.

Live on npm for 9 hours and 47 minutes before removal. Socket users were protected even while the package was live.

This module collects extensive system and CI/CD environment metadata—including hostname, platform, architecture, Node version, current working directory, username, home-directory contents, network interfaces, filtered environment variables related to CI (Azure, GitHub Actions, GitLab CI, Jenkins, CircleCI, Travis), filesystem probes (workspace paths, directory listings, parent directories), and a SHA-256 fingerprint of host/run identifiers. It immediately sends this data in two parts via HTTPS GET requests to a hardcoded webhook URL: https://webhook[.]site/0df1aac5-4383-4eb7-88a8-293905b74fd6?data=<payload>. After 500 ms it repeats with a second payload. Finally, it performs dns.resolve('1emg6uz88a7kz7jpuq3lqybhg[.]canarytokens[.]com') to beacon execution back to a canarytokens service. Such covert exfiltration and out-of-band beaconing represent malicious reconnaissance/backdoor activity and pose a high security risk.

This source file is the central orchestration for a remote implant/C2 client (Sliver). It collects and transmits detailed host-identifying information, accepts and executes arbitrary tasks from a remote operator, supports runtime reconfiguration (server-supplied C2 addresses), and exposes multiple stealthy execution vectors (DLL exports, service, shellcode). In typical software supply-chain or production contexts this component is malicious and should not be included or executed. Further review of transports, handlers, and pivots modules is required to enumerate C2 endpoints, payload behaviors, and full exploitation capabilities.

This file is a covert/automatic cryptocurrency miner: it connects to a remote mining pool, authorizes with a hardcoded wallet address, receives jobs, computes yespower hashes, and submits valid shares to credit that wallet. In the context of a general-purpose dependency this is malicious (cryptominer/supply-chain abuse). If found bundled in unrelated software, treat as malicious, remove and audit the package and systems where it ran. If part of a documented mining client, behavior is functional but still contains hardcoded credentials and minimal error handling—both poor security practices.

Live on npm for 3 hours and 40 minutes before removal. Socket users were protected even while the package was live.

This extension performs immediate, silent collection of host/user environment data via shell commands and transmits that data to a hardcoded remote server. Behavior matches data exfiltration/telemetry without consent. Given the context (editor extension running with user privileges), this is privacy-invasive and likely malicious for a publicly distributed extension. Recommend treating the package as unsafe: do not install in trusted environments, remove from supply chains, and investigate other files/versions for additional functionality or commands.

Live on openvsx for 8 days, 3 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The code offers convenient completion helpers but contains a high-risk pattern: using eval() on a substring derived from a user-controlled completion string with an attacker-controlled or broad globals mapping. This enables arbitrary code execution and information disclosure of objects available in 'globs'. The fragment is not evidently malicious or obfuscated, but it represents a moderate-to-high security risk in any context where 's' or 'globs' can be influenced by untrusted parties. Recommend removing eval and implementing a safe dotted-name resolution and tightening what globals are exposed.

Live on pypi for 10 hours and 50 minutes before removal. Socket users were protected even while the package was live.