Secure your dependencies. Ship with confidence.

This module contains multiple security issues and at least one explicit indication of malicious intent. The error handler reflects util.inspect(err) into HTML responses (information disclosure and possible XSS) and interpolates authenticationUrl without validation. Most notably, the loginSuccess() page contains the text 'Sucessfully grabbed credentials!', which is a clear red flag — it strongly suggests the page is intended to display harvested credentials or confirm credential theft. Even if other parts are benign, the presence of that message plus unsafe leak of inspected error objects to clients makes this package unsafe to use. Recommend not using this code in production, auditing the repository for credential-harvesting behavior, removing util.inspect() from client responses, and validating/escaping any interpolated URLs and strings.

The source code contains suspicious and potentially malicious behavior by uploading arbitrary local files and detailed metadata to a remote server using hardcoded authentication tokens and device identifiers. This constitutes a significant security risk involving unauthorized data exfiltration and privacy violation. Although no direct malware payload like reverse shells or destructive actions are present, the code should be considered high risk and likely malicious due to its data exfiltration capabilities and lack of user transparency.

This file is an orchestrator for an information-stealing tool. It sequentially runs multiple collectors (browsers, Steam, text files, screenshots, system info), packages collected artifacts, and exfiltrates them to a Telegram bot using hardcoded credentials. Treat this code as malicious: do not run it. Assume the hardcoded bot token and chat id are compromised, rotate/revoke the bot token if possible, and inspect any systems where this ran for data loss. Further static/dynamic analysis of the referenced modules is required to enumerate exact artifacts stolen and network endpoints used.

Live on PyPI for 3 hours and 18 minutes before removal. Socket users were protected even while the package was live.

This code implements an insecure, unauthenticated RPC mechanism that allows remote clients to cause arbitrary code execution and exfiltrate files/system information. Using pickle over an untrusted network and invoking methods by client-supplied names are severe supply-chain/backdoor risks. Do not deploy or reuse this code in production; it should be treated as a backdoor/untrusted remote-execution component unless wrapped with strong authentication, authorization, sandboxing, and safe serialization.

The script covertly ensures a background SSH local port-forward to a hard-coded external host as root, clearing any existing ssh on the same local port first. This pattern is consistent with establishing a covert access or exfiltration channel (notably to a MongoDB-like service on port 27017). It is high-risk: investigate origins of the script, the remote IP, root SSH keys and authorized_keys, and any processes or tools that use local:9999. If unexpected, remove and rotate credentials/keys and perform host compromise analysis.

The code includes a significant security risk in the superSignKey function, which modifies SSH authorized keys. This could be exploited for unauthorized access. Other functions perform cryptographic operations without apparent security issues, but the overall risk is elevated due to the potential misuse of superSignKey.

Live on npm for 12 hours before removal. Socket users were protected even while the package was live.

The code poses a serious security risk by sending private keys over email without encryption or user consent. This can lead to unauthorized access and potential financial loss. The hardcoded credentials further exacerbate the security vulnerability.

The code initiates a detached child process that runs an external script (`smtp-connection/index.js`) with its I/O streams ignored. This pattern is suspicious as it can be used to execute code in the background without direct visibility or control from the parent process. While it could be for legitimate background operations, the combination of detachment, ignored I/O, and unreferencing the child process raises concerns about potential hidden malicious activity, such as data exfiltration or establishing persistent connections.

Live on npm for 7 days, 21 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This fragment is spammy and potentially dangerous as content because it promotes downloads from untrusted hosts, redirector links, raw IP:port addresses, and services (VPNs, account sales). The fragment itself contains no executable code or direct backdoor, but it serves as a high-risk social-engineering vector: following links can lead to malware, credential theft, or fraud. If this HTML/text is bundled in a package (README, docs, or assets) it should be removed or sanitized. Do not click the provided links, and treat any included installers (APK/EXE/DMG) as untrusted until verified. Overall: not programmatic malware, but high security risk due to external links and content.

The script is malicious as it sends sensitive system information to an external server, posing a significant security risk.

Live on npm for 12 days, 23 hours and 24 minutes before removal. Socket users were protected even while the package was live.

The source code contains clear signs of malicious behavior designed to exfiltrate sensitive user credentials. After obtaining Zalo login credentials (cookies, IMEI, userAgent) through QR code login or stored credentials, the code sends this sensitive information along with user identifiers to an external server at https://paradisehrm[.]com/Duy/API/HPA/Paradise using hardcoded authentication credentials (username 'adminApi' and a long password hash). This data exfiltration occurs without user consent and is unrelated to the package's stated functionality. The code also extensively logs sensitive credential data to console.error, increasing the risk of credential leakage through log files. The presence of hardcoded authentication for unauthorized data transmission to an unknown third-party server represents a serious supply chain security threat designed to steal user credentials.

The setup.py itself contains no active malicious code, but it declares and packages a project whose stated purpose is backdoor and shellcode generation. That makes the package highly suspicious and potentially malicious. Without inspecting the listed modules (hackebds.*) we cannot conclusively determine actual malicious payloads, but the intent and risk are high: do not install or use this package in trusted environments. Review the module implementations before any use.

The code demonstrates malicious intent consistent with a backdoor/dropper: it disables security controls, downloads a remote executable over HTTP, stores it under a user-writable Windows path with a name resembling a legitimate system binary, and executes it without validation. This constitutes a high security risk and serious malware risk, particularly in supply chain contexts where such a module could be embedded in a package and run on end-user machines without consent.

Live on npm for 3 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 45 minutes before removal. Socket users were protected even while the package was live.

This code is highly suspicious and effectively malicious: it orchestrates serving phishing templates locally and exposing them publicly via an SSH reverse tunnel, and references storage of harvested IPs and credentials. It also uses unsafe shell execution with unescaped, user-supplied values, creating command-injection risk. Treat this package as hostile; do not run it in production or on any machine that contains or can access sensitive data.

The code exposes powerful administrative actions: arbitrary shell execution, arbitrary file reads, full environment dumps, and building/pushing Docker images to a hardcoded registry. These are not obfuscated but are high-risk capabilities that can be abused for data exfiltration, remote code execution, and supply-chain leakage if the superuser authentication is compromised or misconfigured. The presence of a hardcoded remote image name for docker push is suspicious for unintended outbound artifact exfiltration. Recommendation: avoid including these endpoints in public packages or ensure strict, auditable authentication and input validation; remove hardcoded push targets and avoid returning full environment variables or arbitrary file contents.

This script contains high-risk operations and insecure practices. The most serious issue is copying the local private SSH key to the remote host, which is credential exfiltration and allows the remote host to impersonate the local user elsewhere. Additionally, interpolating passwords and other inputs into shell commands (subprocess.run with shell=True) creates shell injection and credential leakage risks. The code as given contains undefined variables and would not run as-is, but its intent is concerning. Treat this code as dangerous: do not run it with real keys or against untrusted hosts; review and remove any copying of private keys and replace unsafe sudo/password handling and shell interpolation with secure alternatives (use ssh-copy-id for public keys, use ssh-agent or proper key management, avoid echoing passwords, avoid shell=True or properly escape inputs).

`lotusbail` is a malicious npm package that masquerades as a WhatsApp Web API library by forking legitimate Baileys-based code and preserving working messaging functionality. In addition to normal API behavior, it inserts a wrapper around the WhatsApp WebSocket client so that all traffic passing through the library is duplicated for collection. Reported data theft includes WhatsApp authentication tokens and session keys, full message content (sent/received and historical), contact lists (including phone numbers), and transferred media/files. The package also attempts to establish persistent unauthorized access by hijacking the WhatsApp device-linking (“pairing”) workflow using a hardcoded pairing code, effectively linking an attacker-controlled device to the victim’s account; removing the npm dependency does not automatically remove the linked device. To hinder detection, the exfiltration endpoint is hidden behind multiple obfuscation layers, collected data is encrypted (including a custom RSA implementation), and the code includes anti-debugging traps designed to disrupt analysis.

This code exfiltrates the full source file and the local username to a hardcoded remote server, and — if the user consents (or in debug) — executes arbitrary Python code returned by that server. That is a direct remote code execution vector and severe supply-chain/exfiltration risk. Do not run this module in trusted or production environments unless you fully trust and can verify the remote server and response integrity. At minimum require cryptographic signing and local vetting of any code received before execution.

This code contains a clear malicious/unauthorized insertion: within the EventSource polyfill there is a timed callback that, for clients whose timezone matches a hard-coded list, displays a political message using alert() and opens an external change.org URL. This is unrelated to the library's purpose, constitutes supply-chain sabotage/defacement targeting specific locales, and should be considered malicious. Remove or replace the package and audit upstream sources. The rest of the bundle appears to be legitimate application and polyfill code.

The code is intentionally obfuscated and implements a runtime loader/packer which decrypts embedded data and writes executable code into the process memory (using platform-native APIs and /proc/self/mem) and then executes it by patching and invoking runtime method pointers. These are high-confidence indicators of malicious or at minimum highly dangerous behavior for a library dependency: in-memory code injection, modifying CLR internals, and executing hidden payloads. This package should be treated as malicious/untrusted and removed or isolated; further dynamic analysis in a controlled sandbox is recommended for full payload capture and IOCs.

This package contains obfuscated malicious code designed to communicate with suspicious external domains when npm scripts are executed. The Base64 encoding is intentionally used to hide the malicious URL from casual inspection. This represents a clear supply chain security threat.

This module contains multiple security issues and at least one explicit indication of malicious intent. The error handler reflects util.inspect(err) into HTML responses (information disclosure and possible XSS) and interpolates authenticationUrl without validation. Most notably, the loginSuccess() page contains the text 'Sucessfully grabbed credentials!', which is a clear red flag — it strongly suggests the page is intended to display harvested credentials or confirm credential theft. Even if other parts are benign, the presence of that message plus unsafe leak of inspected error objects to clients makes this package unsafe to use. Recommend not using this code in production, auditing the repository for credential-harvesting behavior, removing util.inspect() from client responses, and validating/escaping any interpolated URLs and strings.

The source code contains suspicious and potentially malicious behavior by uploading arbitrary local files and detailed metadata to a remote server using hardcoded authentication tokens and device identifiers. This constitutes a significant security risk involving unauthorized data exfiltration and privacy violation. Although no direct malware payload like reverse shells or destructive actions are present, the code should be considered high risk and likely malicious due to its data exfiltration capabilities and lack of user transparency.

This file is an orchestrator for an information-stealing tool. It sequentially runs multiple collectors (browsers, Steam, text files, screenshots, system info), packages collected artifacts, and exfiltrates them to a Telegram bot using hardcoded credentials. Treat this code as malicious: do not run it. Assume the hardcoded bot token and chat id are compromised, rotate/revoke the bot token if possible, and inspect any systems where this ran for data loss. Further static/dynamic analysis of the referenced modules is required to enumerate exact artifacts stolen and network endpoints used.

Live on PyPI for 3 hours and 18 minutes before removal. Socket users were protected even while the package was live.

This code implements an insecure, unauthenticated RPC mechanism that allows remote clients to cause arbitrary code execution and exfiltrate files/system information. Using pickle over an untrusted network and invoking methods by client-supplied names are severe supply-chain/backdoor risks. Do not deploy or reuse this code in production; it should be treated as a backdoor/untrusted remote-execution component unless wrapped with strong authentication, authorization, sandboxing, and safe serialization.

The script covertly ensures a background SSH local port-forward to a hard-coded external host as root, clearing any existing ssh on the same local port first. This pattern is consistent with establishing a covert access or exfiltration channel (notably to a MongoDB-like service on port 27017). It is high-risk: investigate origins of the script, the remote IP, root SSH keys and authorized_keys, and any processes or tools that use local:9999. If unexpected, remove and rotate credentials/keys and perform host compromise analysis.

The code includes a significant security risk in the superSignKey function, which modifies SSH authorized keys. This could be exploited for unauthorized access. Other functions perform cryptographic operations without apparent security issues, but the overall risk is elevated due to the potential misuse of superSignKey.

Live on npm for 12 hours before removal. Socket users were protected even while the package was live.

The code poses a serious security risk by sending private keys over email without encryption or user consent. This can lead to unauthorized access and potential financial loss. The hardcoded credentials further exacerbate the security vulnerability.

The code initiates a detached child process that runs an external script (`smtp-connection/index.js`) with its I/O streams ignored. This pattern is suspicious as it can be used to execute code in the background without direct visibility or control from the parent process. While it could be for legitimate background operations, the combination of detachment, ignored I/O, and unreferencing the child process raises concerns about potential hidden malicious activity, such as data exfiltration or establishing persistent connections.

Live on npm for 7 days, 21 hours and 14 minutes before removal. Socket users were protected even while the package was live.

This fragment is spammy and potentially dangerous as content because it promotes downloads from untrusted hosts, redirector links, raw IP:port addresses, and services (VPNs, account sales). The fragment itself contains no executable code or direct backdoor, but it serves as a high-risk social-engineering vector: following links can lead to malware, credential theft, or fraud. If this HTML/text is bundled in a package (README, docs, or assets) it should be removed or sanitized. Do not click the provided links, and treat any included installers (APK/EXE/DMG) as untrusted until verified. Overall: not programmatic malware, but high security risk due to external links and content.

The script is malicious as it sends sensitive system information to an external server, posing a significant security risk.

Live on npm for 12 days, 23 hours and 24 minutes before removal. Socket users were protected even while the package was live.

The source code contains clear signs of malicious behavior designed to exfiltrate sensitive user credentials. After obtaining Zalo login credentials (cookies, IMEI, userAgent) through QR code login or stored credentials, the code sends this sensitive information along with user identifiers to an external server at https://paradisehrm[.]com/Duy/API/HPA/Paradise using hardcoded authentication credentials (username 'adminApi' and a long password hash). This data exfiltration occurs without user consent and is unrelated to the package's stated functionality. The code also extensively logs sensitive credential data to console.error, increasing the risk of credential leakage through log files. The presence of hardcoded authentication for unauthorized data transmission to an unknown third-party server represents a serious supply chain security threat designed to steal user credentials.

The setup.py itself contains no active malicious code, but it declares and packages a project whose stated purpose is backdoor and shellcode generation. That makes the package highly suspicious and potentially malicious. Without inspecting the listed modules (hackebds.*) we cannot conclusively determine actual malicious payloads, but the intent and risk are high: do not install or use this package in trusted environments. Review the module implementations before any use.

The code demonstrates malicious intent consistent with a backdoor/dropper: it disables security controls, downloads a remote executable over HTTP, stores it under a user-writable Windows path with a name resembling a legitimate system binary, and executes it without validation. This constitutes a high security risk and serious malware risk, particularly in supply chain contexts where such a module could be embedded in a package and run on end-user machines without consent.

Live on npm for 3 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 45 minutes before removal. Socket users were protected even while the package was live.

This code is highly suspicious and effectively malicious: it orchestrates serving phishing templates locally and exposing them publicly via an SSH reverse tunnel, and references storage of harvested IPs and credentials. It also uses unsafe shell execution with unescaped, user-supplied values, creating command-injection risk. Treat this package as hostile; do not run it in production or on any machine that contains or can access sensitive data.

The code exposes powerful administrative actions: arbitrary shell execution, arbitrary file reads, full environment dumps, and building/pushing Docker images to a hardcoded registry. These are not obfuscated but are high-risk capabilities that can be abused for data exfiltration, remote code execution, and supply-chain leakage if the superuser authentication is compromised or misconfigured. The presence of a hardcoded remote image name for docker push is suspicious for unintended outbound artifact exfiltration. Recommendation: avoid including these endpoints in public packages or ensure strict, auditable authentication and input validation; remove hardcoded push targets and avoid returning full environment variables or arbitrary file contents.

This script contains high-risk operations and insecure practices. The most serious issue is copying the local private SSH key to the remote host, which is credential exfiltration and allows the remote host to impersonate the local user elsewhere. Additionally, interpolating passwords and other inputs into shell commands (subprocess.run with shell=True) creates shell injection and credential leakage risks. The code as given contains undefined variables and would not run as-is, but its intent is concerning. Treat this code as dangerous: do not run it with real keys or against untrusted hosts; review and remove any copying of private keys and replace unsafe sudo/password handling and shell interpolation with secure alternatives (use ssh-copy-id for public keys, use ssh-agent or proper key management, avoid echoing passwords, avoid shell=True or properly escape inputs).

`lotusbail` is a malicious npm package that masquerades as a WhatsApp Web API library by forking legitimate Baileys-based code and preserving working messaging functionality. In addition to normal API behavior, it inserts a wrapper around the WhatsApp WebSocket client so that all traffic passing through the library is duplicated for collection. Reported data theft includes WhatsApp authentication tokens and session keys, full message content (sent/received and historical), contact lists (including phone numbers), and transferred media/files. The package also attempts to establish persistent unauthorized access by hijacking the WhatsApp device-linking (“pairing”) workflow using a hardcoded pairing code, effectively linking an attacker-controlled device to the victim’s account; removing the npm dependency does not automatically remove the linked device. To hinder detection, the exfiltration endpoint is hidden behind multiple obfuscation layers, collected data is encrypted (including a custom RSA implementation), and the code includes anti-debugging traps designed to disrupt analysis.

This code exfiltrates the full source file and the local username to a hardcoded remote server, and — if the user consents (or in debug) — executes arbitrary Python code returned by that server. That is a direct remote code execution vector and severe supply-chain/exfiltration risk. Do not run this module in trusted or production environments unless you fully trust and can verify the remote server and response integrity. At minimum require cryptographic signing and local vetting of any code received before execution.

This code contains a clear malicious/unauthorized insertion: within the EventSource polyfill there is a timed callback that, for clients whose timezone matches a hard-coded list, displays a political message using alert() and opens an external change.org URL. This is unrelated to the library's purpose, constitutes supply-chain sabotage/defacement targeting specific locales, and should be considered malicious. Remove or replace the package and audit upstream sources. The rest of the bundle appears to be legitimate application and polyfill code.

The code is intentionally obfuscated and implements a runtime loader/packer which decrypts embedded data and writes executable code into the process memory (using platform-native APIs and /proc/self/mem) and then executes it by patching and invoking runtime method pointers. These are high-confidence indicators of malicious or at minimum highly dangerous behavior for a library dependency: in-memory code injection, modifying CLR internals, and executing hidden payloads. This package should be treated as malicious/untrusted and removed or isolated; further dynamic analysis in a controlled sandbox is recommended for full payload capture and IOCs.

This package contains obfuscated malicious code designed to communicate with suspicious external domains when npm scripts are executed. The Base64 encoding is intentionally used to hide the malicious URL from casual inspection. This represents a clear supply chain security threat.