Secure your dependencies. Ship with confidence.

The code exhibits behaviors typical of malware, such as unauthorized data collection and transmission to an external server. The use of a Discord webhook for data exfiltration is particularly concerning. The provided reports are placeholders and do not offer any analysis, necessitating a reevaluation based on the code's behavior.

`njongto_duo` pitches itself as a Windows-only autoposter for Naver stock-discussion rooms (종목토론방) and Kakao OpenTalk channels, targeting grey-hat promoters who want to flood finance forums with ticker hype. When executed it opens a Korean-language Glimmer-DSL-LibUI dialog that asks for the operator’s Naver ID and password. The instant those credentials are submitted (before any posting begins) the script silently bundles the plaintext ID, password, and the host’s MAC address, then exfiltrates the package via HTTP POST to http://appspace[.]kr/bbs/login_check.php, an endpoint controlled by the zon threat actor. The MAC address doubles as a hardware fingerprint, letting the threat actor correlate victims across multiple installations and campaigns. Although the gem does run its promised stock-forum spam routine, this covert exfiltration turns `njongto_duo` into an infostealer: users hoping to amplify market chatter instead surrender their own sensitive credentials to the threat actor behind the wider “zon” malware cluster.

Significant supply-chain and runtime risk due to load_hooks() forcibly marking all hooks as trusted, combined with shell-based command execution and payload piping. If hooks.toml or CLI specs are compromised, attackers can execute arbitrary commands with access to task payloads. Improve by removing unconditional trust elevation, implementing provenance-based trust (e.g., digital signatures or origin checks), and replacing shell invocation with safer, explicit process execution with strict argument validation. Consider isolating hook execution and minimizing payload exposure to hooks.

This module contains a critical supply-chain remote code execution mechanism: at load time it fetches JavaScript from a public CDN (unpkg) and executes it via eval to populate globalThis.use, with no integrity/pinning. This is high-confidence malicious/sabotage/backdoor behavior risk. The remaining code is largely model mapping/validation and optional metadata fetching, but it is overshadowed by the eval(fetch(...)) bootstrap.

This code fragment contains multiple independently high-risk behaviors: (1) a Windows/WSL execution path that launches PowerShell with ExecutionPolicy Bypass and EncodedCommand (encoded payload execution), (2) a TCP port-probing helper using repeated net.createConnection attempts, and (3) a Firebase auth UI that serializes the OAuth/Firebase credential and places it into window.location.search as base64 in a URL query parameter. These patterns strongly suggest malicious launcher/exfiltration intent rather than benign utility functionality. Additional parts of the bundle appear to be unrelated helper libraries, but they do not explain away the credential-in-URL and encoded PowerShell execution.

This module contains a high-impact cloud synchronization mechanism that can exfiltrate apiKeys and provider credential material to an environment-controlled external endpoint using a stable machine identifier derived from OS fingerprinting. It also appears to propagate provider secret fields from the cloud back into local storage, creating a remote configuration/secret injection path. Although request validation and cookie parsing look normal, the secret-bearing sync behavior and system identifier collection are strong security red flags and require review, allowlisting of destinations, and minimization/authorization controls.

This SQLite database file contains embedded explicit adult content and torrent distribution infrastructure instead of legitimate data. The file includes extensive HTML fragments with pornographic video metadata, download links to torrent files, and suspicious redirect URLs. Key malicious domains identified include rmdown[.]com, redircdn[.]com, 97p[.]org, qpic[.]ws, imgbox[.]com, and various other image hosting services. The content contains hash values for torrent files, BitTorrent magnet links, and obfuscated download URLs using multiple redirect layers to mask the true destinations. This represents a supply chain attack where adult content distribution infrastructure has been embedded within what appears to be a standard database file, potentially exposing users to inappropriate content and malicious download sites when accessed.

The script is designed to send critical system information and environment variables to an external server, which is highly suspicious and indicative of malicious behavior.

Live on npm for 44 minutes before removal. Socket users were protected even while the package was live.

This fragment implements a surveillance/privacy-invasive behavior: upon receiving 'action' runtime messages, it activates the sender tab, posts arbitrary action data to a local HTTP endpoint, captures the currently visible tab as a PNG, base64-encodes it, and posts the screenshot to another local endpoint. While using localhost limits remote exposure, the absence of sender trust checks, user-consent gating, authentication, and payload validation means it could be readily abused by other extension components or a compromised message source. Review is strongly recommended before use.

This module contains malicious code designed to hijack cryptocurrency transactions on HyperLiquid-based decentralized applications. It activates only on specific sites and employs aggressive runtime patching: it pollutes the global `Object.prototype` to intercept `useContext` calls and overrides `Object.keys`. These hooks inspect in-memory objects for order-related structures (checking for specific fields like `hyperliquid.order_type` or order arrays). When a matching order object is found, the code silently mutates it to inject a `builder` field containing a hardcoded address and fee rate. This behavior effectively diverts trading fees or affiliate rewards to the malicious actor.

The code exhibits a dangerous remote code execution pattern: it downloads and immediately runs a remote Python payload without integrity checks, sandboxing, or input validation. This creates a severe supply-chain and runtime security risk. Recommended mitigations include removing dynamic downloads, validating payloads with cryptographic hashes or signatures, using safe subprocess invocations with argument lists, and implementing strict input sanitization. If remote functionality must remain, switch to a trusted-internal mechanism (e.g., plugin architecture with signed components, offline verification) and add robust error handling and logging.

This file is a high-risk catalog of HTML dangling-markup payloads explicitly designed to bypass CSP/script restrictions and exfiltrate page content to an attacker-controlled domain. Treat entries as malicious input: do not render or store them where they could reach HTML rendering contexts without strict sanitization and CSP. Remediation: remove or quarantine the catalog if not required for legitimate testing, sanitize/escape user input, enforce strict CSP and origin restrictions for resource/form targets, and audit any places that reflect user-supplied HTML.

The code is highly suspicious as it exfiltrates all environment variables to an external server, which could include sensitive information such as API keys, database credentials, etc. This behavior is indicative of malicious intent.

Live on npm for 1 day, 11 hours and 28 minutes before removal. Socket users were protected even while the package was live.

This SQLite database file contains embedded explicit adult content and torrent distribution infrastructure instead of legitimate data. The file includes extensive HTML fragments with pornographic video metadata, download links to torrent files, and suspicious redirect URLs. Key malicious domains identified include rmdown[.]com, redircdn[.]com, 97p[.]org, qpic[.]ws, imgbox[.]com, and various other image hosting services. The content contains hash values for torrent files, BitTorrent magnet links, and obfuscated download URLs using multiple redirect layers to mask the true destinations. This represents a supply chain attack where adult content distribution infrastructure has been embedded within what appears to be a standard database file, potentially exposing users to inappropriate content and malicious download sites when accessed.

High-risk and strongly suspicious: this code fragment implements a dual-environment script compiler/interpreter that converts external/untrusted content into JavaScript and executes it directly (core.eval, vm.Script.runInThisContext, and browser <script> injection). It also includes a filesystem-to-eval function and can load remote script sources over the network, with helper utilities that can support persistence and data packaging. Treat as an arbitrary code execution engine/backdoor-like behavior unless tightly sandboxed and provenance-verified.

This script pings a remote endpoint and then sends the collected output to a remote server via curl (e.g., https://1c6c-34-168-173-48[.]ngrok-free[.]app), potentially exfiltrating network and system data without authorization. This behavior poses a security risk and suggests malicious activity.

Live on npm for 9 days, 8 hours and 58 minutes before removal. Socket users were protected even while the package was live.

This module contains a high-impact client-side arbitrary code execution primitive. It deserializes function-like strings from attacker-controlled sources (URL query parameters and the options HTML attribute) and turns them into executable JavaScript via new Function. It also persists function source back into the URL, enabling repeatable exploitation via crafted links. This is a strong indicator of malicious capability or, at minimum, an extremely dangerous design that should not be used with untrusted input.

The code contains insecure patterns that enable remote code execution: it unpickles data directly from HTTP responses (both streaming and full responses) after base64 decoding. This is the primary dangerous behavior. Combined with dynamic URL sourcing from Redis and transmission of pickled runtime data in headers, the module can be abused by a malicious or compromised remote server to execute arbitrary code and exfiltrate data. There is no clear sign the author intended malicious behavior, but the insecure deserialization makes the package dangerous to use against untrusted servers or in environments where Redis or endpoints may be controlled by attackers. Recommend not using this code as-is in untrusted settings; replace pickle-based network deserialization with a safe format or verify/cryptographically sign serialized payloads.

This code is a highly malicious phishing/reverse-proxy configuration targeting real blockchain.com/blockchain.info login flows. It harvests user credentials and uses injected JavaScript to automate backup/recovery UI actions, scrape the resulting recovery phrase from the DOM, and exfiltrate it via POST to an attacker endpoint ('/backupwords'). It also rewrites navigation to keep victims on the capture flow and redirects after exfiltration to reduce detection. Immediate remediation is warranted; the artifact should not be used.

The snippet collects sensitive runtime and environment data (including the entire process.env) and exfiltrates it via two network channels (DNS and HTTP) to an attacker-controlled domain. The behavior is consistent with covert data exfiltration / supply-chain backdoor. This should be classified as malicious: remove the package, investigate exposures, rotate secrets, and block related network egress.

WebLogic CORBA/IIOP exploitation framework containing hardcoded exploit payloads for binding/rebinding remote objects and executing remote constructor payloads. The code implements multi-stage attacks including backdoor installation capabilities through serialized Java bytecode injection. Contains embedded hex-encoded payloads targeting WebLogic internal classes (weblogic[.]corba[.]cos[.]naming[.]NamingContextAny) and CORBA naming contexts. Functionality includes remote command execution through getServerLocation method calls and JNDI manipulation attacks. While this is legitimate penetration testing code within a security framework, the presence of ready-to-use exploit payloads and backdoor installation mechanisms represents unusual patterns that security tools should flag for review.

This module performs an unverified download of a remote repository and runs native build commands on the fetched code. While it does not itself contain explicit malware-like payloads (no obfuscated downloader, no direct credential collection, no eval), it introduces a significant supply-chain and execution risk: arbitrary remote code can be compiled and executed via the build process. Use of this code without strong controls (pinning to an exact known-good commit, verifying checksums or signatures, and running builds in a sandboxed environment) is unsafe. The observed bug (returning 'Non') should be fixed.

Live on pypi for 5 hours and 22 minutes before removal. Socket users were protected even while the package was live.

This code implements an unauthenticated HTTP control surface for a viewer object that accepts arbitrary commands from request paths and bodies, dynamically looks up and calls attributes on internal objects, loads JSON from requests and triggers callbacks, and serves local files. These behaviors make it high risk for supply-chain or runtime compromise: untrusted clients can invoke methods and mutate state which could lead to data exfiltration, filesystem access, or other damaging actions depending on the viewer's API. It should not be exposed to untrusted networks or used without strict authentication/authorization and input validation.

The code exhibits behaviors typical of malware, such as unauthorized data collection and transmission to an external server. The use of a Discord webhook for data exfiltration is particularly concerning. The provided reports are placeholders and do not offer any analysis, necessitating a reevaluation based on the code's behavior.

`njongto_duo` pitches itself as a Windows-only autoposter for Naver stock-discussion rooms (종목토론방) and Kakao OpenTalk channels, targeting grey-hat promoters who want to flood finance forums with ticker hype. When executed it opens a Korean-language Glimmer-DSL-LibUI dialog that asks for the operator’s Naver ID and password. The instant those credentials are submitted (before any posting begins) the script silently bundles the plaintext ID, password, and the host’s MAC address, then exfiltrates the package via HTTP POST to http://appspace[.]kr/bbs/login_check.php, an endpoint controlled by the zon threat actor. The MAC address doubles as a hardware fingerprint, letting the threat actor correlate victims across multiple installations and campaigns. Although the gem does run its promised stock-forum spam routine, this covert exfiltration turns `njongto_duo` into an infostealer: users hoping to amplify market chatter instead surrender their own sensitive credentials to the threat actor behind the wider “zon” malware cluster.

Significant supply-chain and runtime risk due to load_hooks() forcibly marking all hooks as trusted, combined with shell-based command execution and payload piping. If hooks.toml or CLI specs are compromised, attackers can execute arbitrary commands with access to task payloads. Improve by removing unconditional trust elevation, implementing provenance-based trust (e.g., digital signatures or origin checks), and replacing shell invocation with safer, explicit process execution with strict argument validation. Consider isolating hook execution and minimizing payload exposure to hooks.

This module contains a critical supply-chain remote code execution mechanism: at load time it fetches JavaScript from a public CDN (unpkg) and executes it via eval to populate globalThis.use, with no integrity/pinning. This is high-confidence malicious/sabotage/backdoor behavior risk. The remaining code is largely model mapping/validation and optional metadata fetching, but it is overshadowed by the eval(fetch(...)) bootstrap.

This code fragment contains multiple independently high-risk behaviors: (1) a Windows/WSL execution path that launches PowerShell with ExecutionPolicy Bypass and EncodedCommand (encoded payload execution), (2) a TCP port-probing helper using repeated net.createConnection attempts, and (3) a Firebase auth UI that serializes the OAuth/Firebase credential and places it into window.location.search as base64 in a URL query parameter. These patterns strongly suggest malicious launcher/exfiltration intent rather than benign utility functionality. Additional parts of the bundle appear to be unrelated helper libraries, but they do not explain away the credential-in-URL and encoded PowerShell execution.

This module contains a high-impact cloud synchronization mechanism that can exfiltrate apiKeys and provider credential material to an environment-controlled external endpoint using a stable machine identifier derived from OS fingerprinting. It also appears to propagate provider secret fields from the cloud back into local storage, creating a remote configuration/secret injection path. Although request validation and cookie parsing look normal, the secret-bearing sync behavior and system identifier collection are strong security red flags and require review, allowlisting of destinations, and minimization/authorization controls.

This SQLite database file contains embedded explicit adult content and torrent distribution infrastructure instead of legitimate data. The file includes extensive HTML fragments with pornographic video metadata, download links to torrent files, and suspicious redirect URLs. Key malicious domains identified include rmdown[.]com, redircdn[.]com, 97p[.]org, qpic[.]ws, imgbox[.]com, and various other image hosting services. The content contains hash values for torrent files, BitTorrent magnet links, and obfuscated download URLs using multiple redirect layers to mask the true destinations. This represents a supply chain attack where adult content distribution infrastructure has been embedded within what appears to be a standard database file, potentially exposing users to inappropriate content and malicious download sites when accessed.

The script is designed to send critical system information and environment variables to an external server, which is highly suspicious and indicative of malicious behavior.

Live on npm for 44 minutes before removal. Socket users were protected even while the package was live.

This fragment implements a surveillance/privacy-invasive behavior: upon receiving 'action' runtime messages, it activates the sender tab, posts arbitrary action data to a local HTTP endpoint, captures the currently visible tab as a PNG, base64-encodes it, and posts the screenshot to another local endpoint. While using localhost limits remote exposure, the absence of sender trust checks, user-consent gating, authentication, and payload validation means it could be readily abused by other extension components or a compromised message source. Review is strongly recommended before use.

This module contains malicious code designed to hijack cryptocurrency transactions on HyperLiquid-based decentralized applications. It activates only on specific sites and employs aggressive runtime patching: it pollutes the global `Object.prototype` to intercept `useContext` calls and overrides `Object.keys`. These hooks inspect in-memory objects for order-related structures (checking for specific fields like `hyperliquid.order_type` or order arrays). When a matching order object is found, the code silently mutates it to inject a `builder` field containing a hardcoded address and fee rate. This behavior effectively diverts trading fees or affiliate rewards to the malicious actor.

The code exhibits a dangerous remote code execution pattern: it downloads and immediately runs a remote Python payload without integrity checks, sandboxing, or input validation. This creates a severe supply-chain and runtime security risk. Recommended mitigations include removing dynamic downloads, validating payloads with cryptographic hashes or signatures, using safe subprocess invocations with argument lists, and implementing strict input sanitization. If remote functionality must remain, switch to a trusted-internal mechanism (e.g., plugin architecture with signed components, offline verification) and add robust error handling and logging.

This file is a high-risk catalog of HTML dangling-markup payloads explicitly designed to bypass CSP/script restrictions and exfiltrate page content to an attacker-controlled domain. Treat entries as malicious input: do not render or store them where they could reach HTML rendering contexts without strict sanitization and CSP. Remediation: remove or quarantine the catalog if not required for legitimate testing, sanitize/escape user input, enforce strict CSP and origin restrictions for resource/form targets, and audit any places that reflect user-supplied HTML.

The code is highly suspicious as it exfiltrates all environment variables to an external server, which could include sensitive information such as API keys, database credentials, etc. This behavior is indicative of malicious intent.

Live on npm for 1 day, 11 hours and 28 minutes before removal. Socket users were protected even while the package was live.

This SQLite database file contains embedded explicit adult content and torrent distribution infrastructure instead of legitimate data. The file includes extensive HTML fragments with pornographic video metadata, download links to torrent files, and suspicious redirect URLs. Key malicious domains identified include rmdown[.]com, redircdn[.]com, 97p[.]org, qpic[.]ws, imgbox[.]com, and various other image hosting services. The content contains hash values for torrent files, BitTorrent magnet links, and obfuscated download URLs using multiple redirect layers to mask the true destinations. This represents a supply chain attack where adult content distribution infrastructure has been embedded within what appears to be a standard database file, potentially exposing users to inappropriate content and malicious download sites when accessed.

High-risk and strongly suspicious: this code fragment implements a dual-environment script compiler/interpreter that converts external/untrusted content into JavaScript and executes it directly (core.eval, vm.Script.runInThisContext, and browser <script> injection). It also includes a filesystem-to-eval function and can load remote script sources over the network, with helper utilities that can support persistence and data packaging. Treat as an arbitrary code execution engine/backdoor-like behavior unless tightly sandboxed and provenance-verified.

This script pings a remote endpoint and then sends the collected output to a remote server via curl (e.g., https://1c6c-34-168-173-48[.]ngrok-free[.]app), potentially exfiltrating network and system data without authorization. This behavior poses a security risk and suggests malicious activity.

Live on npm for 9 days, 8 hours and 58 minutes before removal. Socket users were protected even while the package was live.

This module contains a high-impact client-side arbitrary code execution primitive. It deserializes function-like strings from attacker-controlled sources (URL query parameters and the options HTML attribute) and turns them into executable JavaScript via new Function. It also persists function source back into the URL, enabling repeatable exploitation via crafted links. This is a strong indicator of malicious capability or, at minimum, an extremely dangerous design that should not be used with untrusted input.

The code contains insecure patterns that enable remote code execution: it unpickles data directly from HTTP responses (both streaming and full responses) after base64 decoding. This is the primary dangerous behavior. Combined with dynamic URL sourcing from Redis and transmission of pickled runtime data in headers, the module can be abused by a malicious or compromised remote server to execute arbitrary code and exfiltrate data. There is no clear sign the author intended malicious behavior, but the insecure deserialization makes the package dangerous to use against untrusted servers or in environments where Redis or endpoints may be controlled by attackers. Recommend not using this code as-is in untrusted settings; replace pickle-based network deserialization with a safe format or verify/cryptographically sign serialized payloads.

This code is a highly malicious phishing/reverse-proxy configuration targeting real blockchain.com/blockchain.info login flows. It harvests user credentials and uses injected JavaScript to automate backup/recovery UI actions, scrape the resulting recovery phrase from the DOM, and exfiltrate it via POST to an attacker endpoint ('/backupwords'). It also rewrites navigation to keep victims on the capture flow and redirects after exfiltration to reduce detection. Immediate remediation is warranted; the artifact should not be used.

The snippet collects sensitive runtime and environment data (including the entire process.env) and exfiltrates it via two network channels (DNS and HTTP) to an attacker-controlled domain. The behavior is consistent with covert data exfiltration / supply-chain backdoor. This should be classified as malicious: remove the package, investigate exposures, rotate secrets, and block related network egress.

WebLogic CORBA/IIOP exploitation framework containing hardcoded exploit payloads for binding/rebinding remote objects and executing remote constructor payloads. The code implements multi-stage attacks including backdoor installation capabilities through serialized Java bytecode injection. Contains embedded hex-encoded payloads targeting WebLogic internal classes (weblogic[.]corba[.]cos[.]naming[.]NamingContextAny) and CORBA naming contexts. Functionality includes remote command execution through getServerLocation method calls and JNDI manipulation attacks. While this is legitimate penetration testing code within a security framework, the presence of ready-to-use exploit payloads and backdoor installation mechanisms represents unusual patterns that security tools should flag for review.

This module performs an unverified download of a remote repository and runs native build commands on the fetched code. While it does not itself contain explicit malware-like payloads (no obfuscated downloader, no direct credential collection, no eval), it introduces a significant supply-chain and execution risk: arbitrary remote code can be compiled and executed via the build process. Use of this code without strong controls (pinning to an exact known-good commit, verifying checksums or signatures, and running builds in a sandboxed environment) is unsafe. The observed bug (returning 'Non') should be fixed.

Live on pypi for 5 hours and 22 minutes before removal. Socket users were protected even while the package was live.

This code implements an unauthenticated HTTP control surface for a viewer object that accepts arbitrary commands from request paths and bodies, dynamically looks up and calls attributes on internal objects, loads JSON from requests and triggers callbacks, and serves local files. These behaviors make it high risk for supply-chain or runtime compromise: untrusted clients can invoke methods and mutate state which could lead to data exfiltration, filesystem access, or other damaging actions depending on the viewer's API. It should not be exposed to untrusted networks or used without strict authentication/authorization and input validation.