Secure your dependencies. Ship with confidence.

Despite being structured as a job scheduler and remote test/reporting client, this module contains a highly suspicious IPC control channel that enables (1) arbitrary command execution via child_process.execSync constructed from IPC-provided inputs and (2) database querying via attacker-controlled parameters, with no authentication/authorization. It additionally persists runner data to a local hardcoded file ('aaa.json') and exfiltrates test/report details over HTTP using api-tokens. If the IPC socket is reachable by an attacker or a compromised process, this module can act as an RCE/backdoor and data-access facilitator, representing a severe supply-chain security risk.

The code is suspicious as it retrieves update information from an unverified external source and uses 'execSync' to run shell commands, which could lead to remote code execution if the external content is compromised. Furthermore, the code attempts to forcibly update and reinstall packages which is not typical for secure update practices.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

This module implements a highly dynamic, high-trust client-side template system that can (1) execute fetched backend JavaScript by injecting inline <script> tags and (2) compile template content into executable code using new Function, then render it. These are direct remote-code-execution patterns in the browser and represent a severe supply-chain/runtime compromise risk if backend/template sources are not strictly integrity-checked. Additional concerns include potential XSS via innerHTML in error rendering and broad CSS/style injection into the live document.

The fragment is an opaque, binary/packed payload or heavily obfuscated content that cannot be reliably analyzed statically. While this alone does not prove malicious intent, it signals high risk and warrants isolation, request for a readable source or deobfuscated form, and controlled dynamic analysis to determine any harmful behavior or data leakage potential.

This module is a high-risk runtime packer/dropper: it embeds an encrypted payload, decrypts it using a user-supplied passphrase, writes the result to `bin/do-setup-circleci-secrets`, and immediately executes it. Because there is no integrity/authenticity validation of the decrypted artifact and the executed code is not shown here, the module should be treated as potentially malicious until the decrypted `bin/do-setup-circleci-secrets` content is inspected and validated in a safe environment.

This SweetAlert2 bundle contains a malicious, targeted payload. For Russian-language users on specific TLDs, after an initiation delay tracked in localStorage and only after >3 days, the code disables page pointer interactions, injects an <audio> element pointing to a hard-coded external MP3 URL, and attempts to auto-play it in a loop. This is defacement/sabotage and unrelated to the library's purpose — likely a supply-chain compromise. Do not use this package; remove or patch the injected block, rotate any exposed credentials (if any), audit upstream package sources, and restore from a verified clean release.

This file is a concentrated collection of active exploit/deserialization payloads designed to detect or trigger known gadget chains and vulnerabilities across multiple platforms. While formatted as a testing catalog, its content is inherently dangerous: it includes explicit command-execution payloads, remote class-loading references, and authentication-bypass tokens. If found in a codebase or dependency, treat as high-risk—remove from production, restrict access, audit any use or transmission logs, and verify no unauthorized target interactions occurred. Only use in controlled, authorized testing environments.

This module contains multiple security issues and at least one explicit indication of malicious intent. The error handler reflects util.inspect(err) into HTML responses (information disclosure and possible XSS) and interpolates authenticationUrl without validation. Most notably, the loginSuccess() page contains the text 'Sucessfully grabbed credentials!', which is a clear red flag — it strongly suggests the page is intended to display harvested credentials or confirm credential theft. Even if other parts are benign, the presence of that message plus unsafe leak of inspected error objects to clients makes this package unsafe to use. Recommend not using this code in production, auditing the repository for credential-harvesting behavior, removing util.inspect() from client responses, and validating/escaping any interpolated URLs and strings.

This module implements Drive client functionality but includes explicit, insecure logic to fetch OAuth credentials and token pickles from an external HTTP service (driver.69hot.info) and write them to local cred/token files, then use them to access Google Drive. This is a high-risk supply-chain/backdoor pattern: a remote service can supply credentials or pickles which could allow arbitrary Drive access or even achieve code execution via malicious pickles. Additional issues: hardcoded API key, requests with verify=False, shell execution via os.system, and lack of integrity/auth checks. Recommended: do not trust or run this package as-is; remove remote automatic credential fetching, validate and authenticate any remote data, avoid loading untrusted pickles, and secure TLS verification.

The code is highly suspicious as it collects sensitive system information and sends it to a hardcoded remote server without user consent. The presence of a message asking users to contact the author for purchasing something raises further red flags. This behavior is indicative of potential data theft or unauthorized tracking.

Live on npm for 20 hours and 41 minutes before removal. Socket users were protected even while the package was live.

This bundle includes a time- and locale-gated malicious/abusive payload unrelated to the library's functionality. It targets users with Russian language settings on Russian domains: after a stored timestamp older than three days it disables page interaction and injects/attempts to play an audio file hosted on 'flag-gimn.ru'. This constitutes targeted nuisance/propaganda behavior and unexpected external network contact. Recommended actions: immediately remove the contaminated bundle or replace it with a verified official SweetAlert2 release from a trusted source; search the codebase and deployment artifacts for similar injected blocks; rotate any credentials if there is suspicion of broader compromise (though none are directly exfiltrated in this fragment); notify affected users and stakeholders; and consider reporting the upstream compromise to maintainers. Treat the external domain access as malicious and block it at network/security controls if possible.

The code contains potential security risks such as hard-coded file paths, subprocess.Popen usage, and the handling of untrusted data through PyArrow Plasma. It is essential to review and address these security concerns before using this code in a production environment.

Live on pypi for 15 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This code presents significant security risks through its ability to fetch dependency lists from a suspicious internal Jenkins server and automatically install packages. The hardcoded Jenkins URL, automatic installation capabilities, and lack of proper validation create potential vectors for supply chain attacks and unauthorized package installation.

The code in the flagged file explicitly reads a local file from a fixed system path (/home/joben/Desktop/testsol/abstract_it.py) and transmits its contents via an HTTP request to a Discord webhook. The target URL is hardcoded as https://discordapp[.]com/api/webhooks/1278595755812327424/3xvzS30Bx8bOhooNJeY9gnYj2KjFb2-ZfV2rHpBdkS71tuibNeu56_mRFE38MrmQRa_j, with the embedded token included in the URL. This behavior is characteristic of malware designed for data exfiltration, as it automatically sends potentially sensitive file content to an external service without user consent.

This module performs a highly suspicious sequence: it injects a hidden iframe pointing to a remote origin, relaxes same-origin policy by changing document.domain to a hardcoded target domain, and then attempts to read the remote iframe’s localStorage. It subsequently exposes that storage object to the caller through Promise/callback. This is consistent with privacy-invasive data harvesting or token/identifier collection rather than legitimate functionality. Additionally, it contains unusual/likely erroneous logic for restoring document.domain and creates an unused second iframe, increasing the likelihood of non-benign intent.

The code forwards sensitive secrets (mail password FASTMAIL_TOKEN and messaging API tokens) and message contents to a single external endpoint (https://tooter.concordium-explorer.nl/notify/) in cleartext within JSON payloads. This pattern is a significant credential exfiltration risk if that endpoint is not fully trusted. There is no obfuscation or dynamic code execution, but the hardcoded mail user and chat id and the practice of embedding passwords/API tokens in payloads are dangerous. Recommend: do not provide real credentials to this library unless you fully trust the remote notify service; replace raw-token forwarding with secure server-side handling, token-scoping, or direct integration with destination services; avoid embedding secrets in URLs or query strings.

Live on pypi for 31 minutes before removal. Socket users were protected even while the package was live.

This file contains malicious code that functions as a backdoor with data exfiltration and remote code execution capabilities. The code systematically collects sensitive system information including all environment variables, platform details, hostname, username, and MAC addresses from network interfaces. This data is then transmitted via HTTP POST request to a suspicious remote server at https://log-server-lovat[.]vercel[.]app/api/ipcheck/703 with a custom header 'x-secret-header: secret'. After sending the collected data, the malware evaluates the server's response as JavaScript code using eval(), enabling arbitrary remote code execution. The code employs obfuscation by hex-encoding critical strings like 'require', 'axios', 'post', and the target URL to evade detection. Error handling is deliberately suppressed to prevent detection of failed operations. This represents a critical supply chain attack vector that compromises system security through both data theft and remote control capabilities.

This module contains a targeted, malicious/ unwanted payload unrelated to its documented purpose. It conditionally injects and plays audio from a hard-coded external domain and temporarily disables page interactions for users in Russian-language browsers on specific country TLDs, using localStorage to limit frequency. This behavior is consistent with a backdoor or sabotage/annoyance injection in the library. Recommendation: do not use this version; treat it as compromised, remove or patch the malicious block, audit the repository history and maintainers, and verify package integrity (compare with upstream signed/tagged releases).

The code is obfuscated and uses decryption, suggesting potential hidden malicious functionality. The presence of file system and network operations raises security concerns. Further deobfuscation and analysis are needed to determine the exact nature of the code.

Live on npm for 18 days, 1 hour and 59 minutes before removal. Socket users were protected even while the package was live.

This module registers a command runner that targets hardcoded plaintext HTTP URLs containing embedded credentials and remote JavaScript resources (e.g., “Doodad.js”), configured to run/retry repeatedly (repetitions: 100) with OS-specific logic. Even though the exact behavior of command.run is not present, the credentialed remote-code staging pattern is highly suspicious and consistent with a supply-chain bootstrap/backdoor mechanism. Review the full file and especially the implementation of command.run and any execution/staging steps it performs.

High-risk behavior consistent with a Windows sandbox/containment installer that nevertheless performs heavy system modifications: creates/resets a local user (QBotClaw_Sandbox), persists its password, edits Winlogon registry, grants logon rights via LSA APIs, and applies ACL DENY rules to credential/config files. This is not typical benign library behavior; if this module is pulled from an npm dependency, it represents a significant supply-chain security risk and should be treated as potentially malicious until verified against trusted source and intended usage.

The code demonstrates potentially harmful behavior by setting up a persistent service on the user's system without clear purpose. It handles environment variables and system commands in a way that could be exploited for malicious purposes. The actual intent of the 'yarn-watcher' program is not clear from this snippet alone, leading to suspicion of its purpose.

The script makes an HTTPS request to a decoded URL, which could be used for data exfiltration or to fetch malicious content. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 41 days and 18 hours before removal. Socket users were protected even while the package was live.

The module implements a Django management command that (if completed) would unconditionally spawn an interactive bash shell via os.system. This is a high-risk backdoor-like capability: while not directly exfiltrating data or contacting remote hosts, it grants full interactive command execution to anyone able to invoke the command. Remove or restrict such commands from production; require explicit access controls, avoid os.system for privileged actions, and prefer safer alternatives (e.g., non-interactive, audited administrative endpoints). The provided snippet is syntactically incomplete, so verify the real source for exact behavior before trusting this report.

No explicit malware (no remote shell, no obfuscation, no code injection). However, there is a significant supply-chain/privacy/credential risk: a hardcoded proxy URL with embedded credentials is set and used (via DI) to route requests to an external host, and the script actively accesses local cameras and logs system information. This could enable data leakage or misuse if the proxy host is malicious. Recommend removing hardcoded credentials, avoid enabling camera checks by default, add request timeouts, and avoid logging sensitive system data.

Live on pypi for 6 hours and 41 minutes before removal. Socket users were protected even while the package was live.

Despite being structured as a job scheduler and remote test/reporting client, this module contains a highly suspicious IPC control channel that enables (1) arbitrary command execution via child_process.execSync constructed from IPC-provided inputs and (2) database querying via attacker-controlled parameters, with no authentication/authorization. It additionally persists runner data to a local hardcoded file ('aaa.json') and exfiltrates test/report details over HTTP using api-tokens. If the IPC socket is reachable by an attacker or a compromised process, this module can act as an RCE/backdoor and data-access facilitator, representing a severe supply-chain security risk.

The code is suspicious as it retrieves update information from an unverified external source and uses 'execSync' to run shell commands, which could lead to remote code execution if the external content is compromised. Furthermore, the code attempts to forcibly update and reinstall packages which is not typical for secure update practices.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

This module implements a highly dynamic, high-trust client-side template system that can (1) execute fetched backend JavaScript by injecting inline <script> tags and (2) compile template content into executable code using new Function, then render it. These are direct remote-code-execution patterns in the browser and represent a severe supply-chain/runtime compromise risk if backend/template sources are not strictly integrity-checked. Additional concerns include potential XSS via innerHTML in error rendering and broad CSS/style injection into the live document.

The fragment is an opaque, binary/packed payload or heavily obfuscated content that cannot be reliably analyzed statically. While this alone does not prove malicious intent, it signals high risk and warrants isolation, request for a readable source or deobfuscated form, and controlled dynamic analysis to determine any harmful behavior or data leakage potential.

This module is a high-risk runtime packer/dropper: it embeds an encrypted payload, decrypts it using a user-supplied passphrase, writes the result to `bin/do-setup-circleci-secrets`, and immediately executes it. Because there is no integrity/authenticity validation of the decrypted artifact and the executed code is not shown here, the module should be treated as potentially malicious until the decrypted `bin/do-setup-circleci-secrets` content is inspected and validated in a safe environment.

This SweetAlert2 bundle contains a malicious, targeted payload. For Russian-language users on specific TLDs, after an initiation delay tracked in localStorage and only after >3 days, the code disables page pointer interactions, injects an <audio> element pointing to a hard-coded external MP3 URL, and attempts to auto-play it in a loop. This is defacement/sabotage and unrelated to the library's purpose — likely a supply-chain compromise. Do not use this package; remove or patch the injected block, rotate any exposed credentials (if any), audit upstream package sources, and restore from a verified clean release.

This file is a concentrated collection of active exploit/deserialization payloads designed to detect or trigger known gadget chains and vulnerabilities across multiple platforms. While formatted as a testing catalog, its content is inherently dangerous: it includes explicit command-execution payloads, remote class-loading references, and authentication-bypass tokens. If found in a codebase or dependency, treat as high-risk—remove from production, restrict access, audit any use or transmission logs, and verify no unauthorized target interactions occurred. Only use in controlled, authorized testing environments.

This module contains multiple security issues and at least one explicit indication of malicious intent. The error handler reflects util.inspect(err) into HTML responses (information disclosure and possible XSS) and interpolates authenticationUrl without validation. Most notably, the loginSuccess() page contains the text 'Sucessfully grabbed credentials!', which is a clear red flag — it strongly suggests the page is intended to display harvested credentials or confirm credential theft. Even if other parts are benign, the presence of that message plus unsafe leak of inspected error objects to clients makes this package unsafe to use. Recommend not using this code in production, auditing the repository for credential-harvesting behavior, removing util.inspect() from client responses, and validating/escaping any interpolated URLs and strings.

This module implements Drive client functionality but includes explicit, insecure logic to fetch OAuth credentials and token pickles from an external HTTP service (driver.69hot.info) and write them to local cred/token files, then use them to access Google Drive. This is a high-risk supply-chain/backdoor pattern: a remote service can supply credentials or pickles which could allow arbitrary Drive access or even achieve code execution via malicious pickles. Additional issues: hardcoded API key, requests with verify=False, shell execution via os.system, and lack of integrity/auth checks. Recommended: do not trust or run this package as-is; remove remote automatic credential fetching, validate and authenticate any remote data, avoid loading untrusted pickles, and secure TLS verification.

The code is highly suspicious as it collects sensitive system information and sends it to a hardcoded remote server without user consent. The presence of a message asking users to contact the author for purchasing something raises further red flags. This behavior is indicative of potential data theft or unauthorized tracking.

Live on npm for 20 hours and 41 minutes before removal. Socket users were protected even while the package was live.

This bundle includes a time- and locale-gated malicious/abusive payload unrelated to the library's functionality. It targets users with Russian language settings on Russian domains: after a stored timestamp older than three days it disables page interaction and injects/attempts to play an audio file hosted on 'flag-gimn.ru'. This constitutes targeted nuisance/propaganda behavior and unexpected external network contact. Recommended actions: immediately remove the contaminated bundle or replace it with a verified official SweetAlert2 release from a trusted source; search the codebase and deployment artifacts for similar injected blocks; rotate any credentials if there is suspicion of broader compromise (though none are directly exfiltrated in this fragment); notify affected users and stakeholders; and consider reporting the upstream compromise to maintainers. Treat the external domain access as malicious and block it at network/security controls if possible.

The code contains potential security risks such as hard-coded file paths, subprocess.Popen usage, and the handling of untrusted data through PyArrow Plasma. It is essential to review and address these security concerns before using this code in a production environment.

Live on pypi for 15 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This code presents significant security risks through its ability to fetch dependency lists from a suspicious internal Jenkins server and automatically install packages. The hardcoded Jenkins URL, automatic installation capabilities, and lack of proper validation create potential vectors for supply chain attacks and unauthorized package installation.

The code in the flagged file explicitly reads a local file from a fixed system path (/home/joben/Desktop/testsol/abstract_it.py) and transmits its contents via an HTTP request to a Discord webhook. The target URL is hardcoded as https://discordapp[.]com/api/webhooks/1278595755812327424/3xvzS30Bx8bOhooNJeY9gnYj2KjFb2-ZfV2rHpBdkS71tuibNeu56_mRFE38MrmQRa_j, with the embedded token included in the URL. This behavior is characteristic of malware designed for data exfiltration, as it automatically sends potentially sensitive file content to an external service without user consent.

This module performs a highly suspicious sequence: it injects a hidden iframe pointing to a remote origin, relaxes same-origin policy by changing document.domain to a hardcoded target domain, and then attempts to read the remote iframe’s localStorage. It subsequently exposes that storage object to the caller through Promise/callback. This is consistent with privacy-invasive data harvesting or token/identifier collection rather than legitimate functionality. Additionally, it contains unusual/likely erroneous logic for restoring document.domain and creates an unused second iframe, increasing the likelihood of non-benign intent.

The code forwards sensitive secrets (mail password FASTMAIL_TOKEN and messaging API tokens) and message contents to a single external endpoint (https://tooter.concordium-explorer.nl/notify/) in cleartext within JSON payloads. This pattern is a significant credential exfiltration risk if that endpoint is not fully trusted. There is no obfuscation or dynamic code execution, but the hardcoded mail user and chat id and the practice of embedding passwords/API tokens in payloads are dangerous. Recommend: do not provide real credentials to this library unless you fully trust the remote notify service; replace raw-token forwarding with secure server-side handling, token-scoping, or direct integration with destination services; avoid embedding secrets in URLs or query strings.

Live on pypi for 31 minutes before removal. Socket users were protected even while the package was live.

This file contains malicious code that functions as a backdoor with data exfiltration and remote code execution capabilities. The code systematically collects sensitive system information including all environment variables, platform details, hostname, username, and MAC addresses from network interfaces. This data is then transmitted via HTTP POST request to a suspicious remote server at https://log-server-lovat[.]vercel[.]app/api/ipcheck/703 with a custom header 'x-secret-header: secret'. After sending the collected data, the malware evaluates the server's response as JavaScript code using eval(), enabling arbitrary remote code execution. The code employs obfuscation by hex-encoding critical strings like 'require', 'axios', 'post', and the target URL to evade detection. Error handling is deliberately suppressed to prevent detection of failed operations. This represents a critical supply chain attack vector that compromises system security through both data theft and remote control capabilities.

This module contains a targeted, malicious/ unwanted payload unrelated to its documented purpose. It conditionally injects and plays audio from a hard-coded external domain and temporarily disables page interactions for users in Russian-language browsers on specific country TLDs, using localStorage to limit frequency. This behavior is consistent with a backdoor or sabotage/annoyance injection in the library. Recommendation: do not use this version; treat it as compromised, remove or patch the malicious block, audit the repository history and maintainers, and verify package integrity (compare with upstream signed/tagged releases).

The code is obfuscated and uses decryption, suggesting potential hidden malicious functionality. The presence of file system and network operations raises security concerns. Further deobfuscation and analysis are needed to determine the exact nature of the code.

Live on npm for 18 days, 1 hour and 59 minutes before removal. Socket users were protected even while the package was live.

This module registers a command runner that targets hardcoded plaintext HTTP URLs containing embedded credentials and remote JavaScript resources (e.g., “Doodad.js”), configured to run/retry repeatedly (repetitions: 100) with OS-specific logic. Even though the exact behavior of command.run is not present, the credentialed remote-code staging pattern is highly suspicious and consistent with a supply-chain bootstrap/backdoor mechanism. Review the full file and especially the implementation of command.run and any execution/staging steps it performs.

High-risk behavior consistent with a Windows sandbox/containment installer that nevertheless performs heavy system modifications: creates/resets a local user (QBotClaw_Sandbox), persists its password, edits Winlogon registry, grants logon rights via LSA APIs, and applies ACL DENY rules to credential/config files. This is not typical benign library behavior; if this module is pulled from an npm dependency, it represents a significant supply-chain security risk and should be treated as potentially malicious until verified against trusted source and intended usage.

The code demonstrates potentially harmful behavior by setting up a persistent service on the user's system without clear purpose. It handles environment variables and system commands in a way that could be exploited for malicious purposes. The actual intent of the 'yarn-watcher' program is not clear from this snippet alone, leading to suspicion of its purpose.

The script makes an HTTPS request to a decoded URL, which could be used for data exfiltration or to fetch malicious content. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 41 days and 18 hours before removal. Socket users were protected even while the package was live.

The module implements a Django management command that (if completed) would unconditionally spawn an interactive bash shell via os.system. This is a high-risk backdoor-like capability: while not directly exfiltrating data or contacting remote hosts, it grants full interactive command execution to anyone able to invoke the command. Remove or restrict such commands from production; require explicit access controls, avoid os.system for privileged actions, and prefer safer alternatives (e.g., non-interactive, audited administrative endpoints). The provided snippet is syntactically incomplete, so verify the real source for exact behavior before trusting this report.

No explicit malware (no remote shell, no obfuscation, no code injection). However, there is a significant supply-chain/privacy/credential risk: a hardcoded proxy URL with embedded credentials is set and used (via DI) to route requests to an external host, and the script actively accesses local cameras and logs system information. This could enable data leakage or misuse if the proxy host is malicious. Recommend removing hardcoded credentials, avoid enabling camera checks by default, add request timeouts, and avoid logging sensitive system data.

Live on pypi for 6 hours and 41 minutes before removal. Socket users were protected even while the package was live.