Secure your dependencies. Ship with confidence.

High-risk due to embedded private keys and API credentials spread across multi-network configurations, coupled with runtime prompts for secrets and broad external dependencies. Immediate remediation should remove all hardcoded secrets, implement secure secret management (environment variables with strict permissions, vaults, or CI/CD secret stores), enforce least-privilege signer creation, and audit all external endpoints. This codebase presents a significant supply-chain risk and potential for unauthorized signing or data exfiltration if deployed as-is.

The code sends sensitive credentials from environment variables over an unencrypted HTTP connection to an external API service at api[.]sqhyw[.]net:90. It authenticates using username/password from the YEZI_USER environment variable, retrieves access tokens, and automates the process of obtaining mobile phone numbers and SMS verification codes. This behavior poses significant supply chain security risks through: (1) leakage of environment variable credentials over unencrypted HTTP, (2) interaction with a suspicious external domain on a non-standard port, (3) logging of potentially sensitive API responses including tokens and SMS codes, and (4) facilitation of SMS verification bypass which could enable fraudulent account creation or spam activities. The code continuously polls the external API for up to 120 seconds to retrieve SMS codes, creating additional operational risks. While not containing traditional malware payloads, the credential exfiltration and suspicious external communication patterns justify classification as malware due to the significant security risks posed to systems that deploy this code.

The code is highly suspicious due to its collection and transmission of system information to external servers without user consent. The use of hardcoded IP addresses and fallback mechanisms for data transmission indicates potential malicious intent.

The fragment is an opaque, binary/packed payload or heavily obfuscated content that cannot be reliably analyzed statically. While this alone does not prove malicious intent, it signals high risk and warrants isolation, request for a readable source or deobfuscated form, and controlled dynamic analysis to determine any harmful behavior or data leakage potential.

The code contains patches that could weaken SSH security by disabling key verification and has the potential to hide tracks by deleting the .git directory. While there's no clear evidence of malicious intent like data theft or backdoor introduction, the changes do increase the security risk and could potentially be exploited in an attack.

The code is malicious as it collects and transmits sensitive user and system data to an external server without consent. This poses a significant security risk.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

This code implements a straightforward reverse SSH TCP tunnel that exposes local services to a remote SSH peer and allows local data to be forwarded to that peer. The implementation itself is not obfuscated and contains no hard-coded credentials, but in the context of an implant package it is consistent with backdoor/tunneling behavior and represents a significant security risk. Recommend treating this component as malicious or high-risk unless its presence is explicitly required and audited; if used legitimately, add access controls, authentication, and stricter logging/visibility to reduce abuse potential.

This code is malicious and implements a covert data-collection and exfiltration mechanism. It gathers local system identifiers and the host public IP, hex-encodes them, and transmits the encoded payload to an attacker-controlled domain via DNS queries while also contacting ifconfig.me. Treat this as a compromise/supply-chain backdoor: do not execute, remove from any codebase, and investigate any systems that ran it.

The code is malicious as it involves unauthorized data exfiltration by sending session cookies to an external server. This poses a significant security risk.

Live on PyPI for 27 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 27 minutes before removal. Socket users were protected even while the package was live.

This module is a logging control server that tolerates remote control and remote log ingestion. The code contains a severe unsafe-deserialization vulnerability: it unpickles data directly from ZMQ sockets (commander and receiver). An attacker able to connect to those sockets can execute arbitrary code via crafted pickle payloads and/or control the logging server (quit/roll/set_level). Additionally, logs are forwarded to a remote textualog endpoint which could leak sensitive information. No obfuscation or explicit malicious payloads are present, but the deserialization pattern and lack of authentication make this code high-risk for remote exploitation and potential supply-chain abuse. Recommend replacing pickle with a safe serialization format (JSON, msgpack with safe types), adding authentication/authorization for command sockets, validating inputs, and auditing what data is logged and forwarded to remote hosts.

Live on PyPI for 1 hour and 48 minutes before removal. Socket users were protected even while the package was live.

This module intentionally embeds and executes hidden LZMA+base64 payloads at import time. That pattern (immediate exec of compressed/encoded blobs and opaque function calls) is highly suspicious and consistent with obfuscation and potential malicious/supply-chain behavior. Treat this file as high risk: do not run or import it in trusted environments. Decompress and audit both payloads in a secure, isolated sandbox before any use.

High risk: the code demonstrates an obfuscated dynamic loader capable of reconstructing and executing arbitrary code at runtime across both Node and browser environments. This is a classic indicator of a potential backdoor or supply-chain dropper. Such patterns should not be trusted in open-source dependencies without rigorous provenance verification, deobfuscation, and signing. Removal or replacement with vetted components is advised.

This script invokes xmrig.exe to perform a cryptomining benchmark using the --bench=1M and --submit parameters, potentially submitting results over the network. Unauthorized execution can consume system resources for mining and send data externally without user consent, making it a malicious threat.

This file contains an explicit data exfiltration channel: tm() sends project configuration and dependency details to a hardcoded Telegram bot token and chat_id using curl invoked via shell exec. Combined with unescaped string concatenation into shell commands (command injection risk) and use of child_process.exec throughout, this is a significant supply-chain/privacy risk. Remediation: remove or disable tm(), remove hardcoded tokens, make telemetry optional and configurable, avoid child_process.exec with shell and prefer spawn/execFile with argument arrays or properly escape inputs, and sanitize any data used in shell contexts. Treat this module as unsafe for inclusion until those issues are fixed.

The script is designed to send telemetry data to a remote server, which poses a significant security risk due to the potential exposure of sensitive information.

Live on npm for 21 minutes before removal. Socket users were protected even while the package was live.

The code presents a strong supply-chain and remote-execution risk by automatically downloading and executing remote Python payloads without integrity checks or sandboxing. It also creates and runs external services (Jupyter, Visdom, RStudio) based on user inputs, which can amplify impact if the remote payload is malicious. Mitigations include removing remote code execution paths, adding cryptographic verification (signatures or hash checks), isolating execution (sandboxes or containerization), validating inputs, and avoiding untrusted downloads or executions.

The script is designed to send sensitive environment variable data to an external server, which is a clear indication of malicious behavior.

Live on npm for 2 days, 13 hours and 48 minutes before removal. Socket users were protected even while the package was live.

The fragment is an opaque, binary/packed payload or heavily obfuscated content that cannot be reliably analyzed statically. While this alone does not prove malicious intent, it signals high risk and warrants isolation, request for a readable source or deobfuscated form, and controlled dynamic analysis to determine any harmful behavior or data leakage potential.

The code is a classic reverse shell implementation, posing a significant security risk by allowing remote command execution on the host system. This behavior is indicative of malicious intent.

Live on npm for 2 hours and 21 minutes before removal. Socket users were protected even while the package was live.

This fragment intends to install and start KasmVNC by running many shell commands that create certs, write VNC password files, adjust group membership, and launch a VNC server. The primary security issues are unsafe shell interpolation (command injection risk), programmatic persistence of a possibly predictable password, execution with sudo based on unvalidated env vars, starting a VNC server exposed on 0.0.0.0 with disabled/basic auth, and multiple unsafe filesystem operations performed via shell. There is no clear evidence of obfuscated or direct exfiltration malware, but the behavior can provide an unauthorized remote access vector (backdoor-like) if used maliciously. Do not run this code without fixing shell usage, validating inputs, using secure randomly generated passwords, enforcing proper file permissions, and not disabling authentication.

This script is highly suspicious and likely malicious as it attempts to exfiltrate sensitive information from the system to a remote server.

Live on npm for 2 days, 2 hours and 7 minutes before removal. Socket users were protected even while the package was live.

The provided code fragment contains an embedded PHP payload designed to enumerate server files, package them into a zip, read and base64-encode the archive, and output it along with extensive server environment information. This is strongly indicative of a webshell or data-exfiltration backdoor. Even though the Python wrapper is syntactically broken and the PHP has small syntax issues (possibly due to truncation), the operational intent is clear and malicious. Treat any occurrence of this payload in a package as high risk: remove the code, investigate how it arrived, search for written PHP files on web roots, and consider rotating credentials and performing a full compromise assessment.

This package modifies user shell startup files without consent and injects a token that will be executed by future shells. That behavior is unexpected for most packages and can be used as a persistence/backdoor mechanism. Even if the injected string is benign in the package's intended context, altering ~/.bashrc or ~/.zshrc silently is a high-risk action and should be treated as malicious or at least unacceptable for a trusted package. Recommend not using this package and removing injected lines from user rc files.

The code imports several external libraries with non-standard names and calls a method 'functame' on each. The behavior and purpose of 'functame' are unclear, and the code does not perform any meaningful operations. Given the anomalies and lack of clear intent, further investigation of the external libraries is recommended. However, there is no direct evidence of malicious activity in this fragment itself.

Live on npm for 57 days, 1 hour and 58 minutes before removal. Socket users were protected even while the package was live.

High-risk due to embedded private keys and API credentials spread across multi-network configurations, coupled with runtime prompts for secrets and broad external dependencies. Immediate remediation should remove all hardcoded secrets, implement secure secret management (environment variables with strict permissions, vaults, or CI/CD secret stores), enforce least-privilege signer creation, and audit all external endpoints. This codebase presents a significant supply-chain risk and potential for unauthorized signing or data exfiltration if deployed as-is.

The code sends sensitive credentials from environment variables over an unencrypted HTTP connection to an external API service at api[.]sqhyw[.]net:90. It authenticates using username/password from the YEZI_USER environment variable, retrieves access tokens, and automates the process of obtaining mobile phone numbers and SMS verification codes. This behavior poses significant supply chain security risks through: (1) leakage of environment variable credentials over unencrypted HTTP, (2) interaction with a suspicious external domain on a non-standard port, (3) logging of potentially sensitive API responses including tokens and SMS codes, and (4) facilitation of SMS verification bypass which could enable fraudulent account creation or spam activities. The code continuously polls the external API for up to 120 seconds to retrieve SMS codes, creating additional operational risks. While not containing traditional malware payloads, the credential exfiltration and suspicious external communication patterns justify classification as malware due to the significant security risks posed to systems that deploy this code.

The code is highly suspicious due to its collection and transmission of system information to external servers without user consent. The use of hardcoded IP addresses and fallback mechanisms for data transmission indicates potential malicious intent.

The fragment is an opaque, binary/packed payload or heavily obfuscated content that cannot be reliably analyzed statically. While this alone does not prove malicious intent, it signals high risk and warrants isolation, request for a readable source or deobfuscated form, and controlled dynamic analysis to determine any harmful behavior or data leakage potential.

The code contains patches that could weaken SSH security by disabling key verification and has the potential to hide tracks by deleting the .git directory. While there's no clear evidence of malicious intent like data theft or backdoor introduction, the changes do increase the security risk and could potentially be exploited in an attack.

The code is malicious as it collects and transmits sensitive user and system data to an external server without consent. This poses a significant security risk.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

This code implements a straightforward reverse SSH TCP tunnel that exposes local services to a remote SSH peer and allows local data to be forwarded to that peer. The implementation itself is not obfuscated and contains no hard-coded credentials, but in the context of an implant package it is consistent with backdoor/tunneling behavior and represents a significant security risk. Recommend treating this component as malicious or high-risk unless its presence is explicitly required and audited; if used legitimately, add access controls, authentication, and stricter logging/visibility to reduce abuse potential.

This code is malicious and implements a covert data-collection and exfiltration mechanism. It gathers local system identifiers and the host public IP, hex-encodes them, and transmits the encoded payload to an attacker-controlled domain via DNS queries while also contacting ifconfig.me. Treat this as a compromise/supply-chain backdoor: do not execute, remove from any codebase, and investigate any systems that ran it.

The code is malicious as it involves unauthorized data exfiltration by sending session cookies to an external server. This poses a significant security risk.

Live on PyPI for 27 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 27 minutes before removal. Socket users were protected even while the package was live.

This module is a logging control server that tolerates remote control and remote log ingestion. The code contains a severe unsafe-deserialization vulnerability: it unpickles data directly from ZMQ sockets (commander and receiver). An attacker able to connect to those sockets can execute arbitrary code via crafted pickle payloads and/or control the logging server (quit/roll/set_level). Additionally, logs are forwarded to a remote textualog endpoint which could leak sensitive information. No obfuscation or explicit malicious payloads are present, but the deserialization pattern and lack of authentication make this code high-risk for remote exploitation and potential supply-chain abuse. Recommend replacing pickle with a safe serialization format (JSON, msgpack with safe types), adding authentication/authorization for command sockets, validating inputs, and auditing what data is logged and forwarded to remote hosts.

Live on PyPI for 1 hour and 48 minutes before removal. Socket users were protected even while the package was live.

This module intentionally embeds and executes hidden LZMA+base64 payloads at import time. That pattern (immediate exec of compressed/encoded blobs and opaque function calls) is highly suspicious and consistent with obfuscation and potential malicious/supply-chain behavior. Treat this file as high risk: do not run or import it in trusted environments. Decompress and audit both payloads in a secure, isolated sandbox before any use.

High risk: the code demonstrates an obfuscated dynamic loader capable of reconstructing and executing arbitrary code at runtime across both Node and browser environments. This is a classic indicator of a potential backdoor or supply-chain dropper. Such patterns should not be trusted in open-source dependencies without rigorous provenance verification, deobfuscation, and signing. Removal or replacement with vetted components is advised.

This script invokes xmrig.exe to perform a cryptomining benchmark using the --bench=1M and --submit parameters, potentially submitting results over the network. Unauthorized execution can consume system resources for mining and send data externally without user consent, making it a malicious threat.

This file contains an explicit data exfiltration channel: tm() sends project configuration and dependency details to a hardcoded Telegram bot token and chat_id using curl invoked via shell exec. Combined with unescaped string concatenation into shell commands (command injection risk) and use of child_process.exec throughout, this is a significant supply-chain/privacy risk. Remediation: remove or disable tm(), remove hardcoded tokens, make telemetry optional and configurable, avoid child_process.exec with shell and prefer spawn/execFile with argument arrays or properly escape inputs, and sanitize any data used in shell contexts. Treat this module as unsafe for inclusion until those issues are fixed.

The script is designed to send telemetry data to a remote server, which poses a significant security risk due to the potential exposure of sensitive information.

Live on npm for 21 minutes before removal. Socket users were protected even while the package was live.

The code presents a strong supply-chain and remote-execution risk by automatically downloading and executing remote Python payloads without integrity checks or sandboxing. It also creates and runs external services (Jupyter, Visdom, RStudio) based on user inputs, which can amplify impact if the remote payload is malicious. Mitigations include removing remote code execution paths, adding cryptographic verification (signatures or hash checks), isolating execution (sandboxes or containerization), validating inputs, and avoiding untrusted downloads or executions.

The script is designed to send sensitive environment variable data to an external server, which is a clear indication of malicious behavior.

Live on npm for 2 days, 13 hours and 48 minutes before removal. Socket users were protected even while the package was live.

The fragment is an opaque, binary/packed payload or heavily obfuscated content that cannot be reliably analyzed statically. While this alone does not prove malicious intent, it signals high risk and warrants isolation, request for a readable source or deobfuscated form, and controlled dynamic analysis to determine any harmful behavior or data leakage potential.

The code is a classic reverse shell implementation, posing a significant security risk by allowing remote command execution on the host system. This behavior is indicative of malicious intent.

Live on npm for 2 hours and 21 minutes before removal. Socket users were protected even while the package was live.

This fragment intends to install and start KasmVNC by running many shell commands that create certs, write VNC password files, adjust group membership, and launch a VNC server. The primary security issues are unsafe shell interpolation (command injection risk), programmatic persistence of a possibly predictable password, execution with sudo based on unvalidated env vars, starting a VNC server exposed on 0.0.0.0 with disabled/basic auth, and multiple unsafe filesystem operations performed via shell. There is no clear evidence of obfuscated or direct exfiltration malware, but the behavior can provide an unauthorized remote access vector (backdoor-like) if used maliciously. Do not run this code without fixing shell usage, validating inputs, using secure randomly generated passwords, enforcing proper file permissions, and not disabling authentication.

This script is highly suspicious and likely malicious as it attempts to exfiltrate sensitive information from the system to a remote server.

Live on npm for 2 days, 2 hours and 7 minutes before removal. Socket users were protected even while the package was live.

The provided code fragment contains an embedded PHP payload designed to enumerate server files, package them into a zip, read and base64-encode the archive, and output it along with extensive server environment information. This is strongly indicative of a webshell or data-exfiltration backdoor. Even though the Python wrapper is syntactically broken and the PHP has small syntax issues (possibly due to truncation), the operational intent is clear and malicious. Treat any occurrence of this payload in a package as high risk: remove the code, investigate how it arrived, search for written PHP files on web roots, and consider rotating credentials and performing a full compromise assessment.

This package modifies user shell startup files without consent and injects a token that will be executed by future shells. That behavior is unexpected for most packages and can be used as a persistence/backdoor mechanism. Even if the injected string is benign in the package's intended context, altering ~/.bashrc or ~/.zshrc silently is a high-risk action and should be treated as malicious or at least unacceptable for a trusted package. Recommend not using this package and removing injected lines from user rc files.

The code imports several external libraries with non-standard names and calls a method 'functame' on each. The behavior and purpose of 'functame' are unclear, and the code does not perform any meaningful operations. Given the anomalies and lack of clear intent, further investigation of the external libraries is recommended. However, there is no direct evidence of malicious activity in this fragment itself.

Live on npm for 57 days, 1 hour and 58 minutes before removal. Socket users were protected even while the package was live.