Quickly evaluate the security and health of any open source package.
azure-graphrbac
8.11.1000
Removed from npm
Blocked by Socket
Possible typosquat of azure-graph
Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.
fiinquant
0.8.8
Live on PyPI
Blocked by Socket
This code uses sophisticated obfuscation techniques to hide its functionality, including base64 encoding, string reversal, zlib compression, and dynamic execution. These are classic characteristics of malicious software designed to evade detection. The code should be considered highly suspicious and potentially dangerous.
77markdownlint-config
0.0.2
by sola67
Live on npm
Blocked by Socket
The code exhibits a serious security risk due to the use of 'eval' and the presence of potentially hidden behavior. Refactoring is necessary to address these risks.
linear-airbyte-source
9.9.10
by nikhilkaushikop
Live on npm
Blocked by Socket
The code is engaging in potentially malicious behavior by collecting and sending sensitive system and user information to suspicious domains without user consent.
iberia-tools
999.9.9
by amigomioteconsidero25
Removed from npm
Blocked by Socket
The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.
Live on npm for 2 hours and 17 minutes before removal. Socket users were protected even while the package was live.
blossom-yarn-fgz947
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code contains several unusual elements including strange package names, inconsistent naming conventions, and a lack of meaningful logic. These characteristics suggest that the code may be obfuscated or intentionally confusing. The peculiar package names could also indicate potential typosquatting. Without more information on the packages being imported, it's difficult to fully assess the intent of the code. However, given the anomalies, there is a moderate security risk associated with this code.
Live on npm for 56 days, 18 hours and 45 minutes before removal. Socket users were protected even while the package was live.
xo-form-components
88.8.8
by agentsteal
Removed from npm
Blocked by Socket
This script is designed to exfiltrate sensitive information from the system to a remote server, indicating malicious behavior.
Live on npm for 39 minutes before removal. Socket users were protected even while the package was live.
int_stripe_sfra
99.9.9
by 0xwise64
Removed from npm
Blocked by Socket
The script collects information like hostname, platform, user info, and current working directory, encodes it in base64, and sends it to a remote server.
Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.
znowflake_client
1.1.9
by Gandalf
Live on Rubygems
Blocked by Socket
This file collects critical system information—including environment variables, user login, local IP, and an external IP (via hxxps://api[.]ipify[.]org)—and sends it to hxxp://example[.]com/2819d620-cd87-4bc0-8b37-fe25d461e06f without user knowledge or consent, posing a significant risk of data exfiltration.
psn-discount-today733
1.0.2
by sicrap
Removed from npm
Blocked by Socket
The script is not necessarily malicious, but it does involve dubious practices like automated publishing of npm packages and programmatically updating a WordPress site. It is also insecure due to the hardcoding of credentials and the potential misuse of automated npm package publishing.
Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.
g8untcotribwatch
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.
plans-grid
1.0.0
by k4r1it0
Removed from npm
Blocked by Socket
The code collects and sends potentially sensitive system data to a remote server without user consent, which is indicative of malicious behavior. This poses a significant security risk due to unauthorized data transmission.
Live on npm for 2 days, 7 hours and 21 minutes before removal. Socket users were protected even while the package was live.
fast
2.5
Removed from PyPI
Blocked by Socket
The script contains several security risks, including hardcoded credentials, use of `eval` with user-supplied data, and dynamic execution of a shell command with user-supplied data. These can lead to credential exposure, code injection, and command injection vulnerabilities. While the primary purpose of the script seems benign, these security risks are significant and should be addressed.
Live on PyPI for 59 minutes before removal. Socket users were protected even while the package was live.
public-api-signature-calculator-example
1.0.0
by antraxio
Removed from npm
Blocked by Socket
The script sends the hostname and the current user to an external server, which is a clear indication of malicious behavior and data exfiltration.
Live on npm for 10 days, 11 hours and 10 minutes before removal. Socket users were protected even while the package was live.
io.github.xz-java:xz-java
1.9.2
Live on Maven
Blocked by Socket
The file contains malicious code that opens a `ServerSocket` on port 11337 and listens for incoming network connections. Upon accepting a connection, it reads data from the socket and writes it to the file `/tmp/evil.sh`. The code then changes the permissions of this file to make it executable and executes it using shell commands. The execution output is written to `/tmp/evil-out.sh`. Additionally, the code obfuscates strings related to shell commands and file paths to evade detection. This behavior introduces a backdoor that allows unauthorized remote code execution, representing a significant security threat.
ai-metrics-advisor
99.10.9
Removed from npm
Blocked by Socket
The code exhibits clear signs of malicious behavior involving data theft and exfiltration. It encodes and sends sensitive system and user data to a suspicious domain via both DNS queries and HTTPS POST requests.
Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.
viihdeonline-shared-components
1.9.99
by dojo-common
Removed from npm
Blocked by Socket
The script collects information like package name, current working directory, username, hostname, and IP address, then sends it to a remote server using DNS requests.
jazz_services-handler
12.0.0
by ganesha_gouri
Removed from npm
Blocked by Socket
This script is designed to exfiltrate environment variables to an external server, which poses a significant security risk and indicates malicious behavior.
Live on npm for 12 days and 7 minutes before removal. Socket users were protected even while the package was live.
@buffer-mono/png-export
10.999.1
by bughunter00
Removed from npm
Blocked by Socket
The code is exfiltrating sensitive system information to an external server, which is a serious security risk and indicative of malicious behavior.
Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.
azure-graphrbac
6.1.1000
Removed from npm
Blocked by Socket
The code is highly suspicious due to its behavior of sending system and project data to external servers without user consent. This indicates potential malicious intent and poses a significant security risk.
Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.
raid-shadow-legends-promo-codes497
1.0.2
by robowxw
Removed from npm
Blocked by Socket
The code poses a significant security risk and should be reviewed. It is recommended to remove unnecessary imports, verify the contents of the data folder and the WordPress websites before proceeding, and avoid using hardcoded credentials for WordPress login.
Live on npm for 54 minutes before removal. Socket users were protected even while the package was live.
sparrow-python
0.4.1
Live on PyPI
Blocked by Socket
The code contains dynamic URL alterations and uses 'os.system' with user inputs, posing a security risk. It is recommended to review the code for safer alternatives.
discord.js-self-v21
1.0.1
by discord-js-selfbotv4
Removed from npm
Blocked by Socket
The code exhibits behavior that is highly indicative of malicious intent, such as downloading and executing files from a remote server without proper validation or user consent. The use of a Discord CDN URL for distributing executables and the absence of integrity checks significantly increase the risk of introducing malware into the system.
Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.
nirvana-dynamo-iun076
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code imports multiple modules with unusual names and calls a method named 'functame' on each of them. The lack of documentation, unconventional naming patterns, and the mysterious method names make this code suspicious. Without additional information on what these modules and methods do, the code could potentially be harmful.
Live on npm for 57 days, 6 hours and 53 minutes before removal. Socket users were protected even while the package was live.
godaddy-utils
999.9.9
by amigomioteconsidero20
Removed from npm
Blocked by Socket
The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.
Live on npm for 1 hour and 47 minutes before removal. Socket users were protected even while the package was live.
azure-graphrbac
8.11.1000
Removed from npm
Blocked by Socket
Possible typosquat of azure-graph
Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.
fiinquant
0.8.8
Live on PyPI
Blocked by Socket
This code uses sophisticated obfuscation techniques to hide its functionality, including base64 encoding, string reversal, zlib compression, and dynamic execution. These are classic characteristics of malicious software designed to evade detection. The code should be considered highly suspicious and potentially dangerous.
77markdownlint-config
0.0.2
by sola67
Live on npm
Blocked by Socket
The code exhibits a serious security risk due to the use of 'eval' and the presence of potentially hidden behavior. Refactoring is necessary to address these risks.
linear-airbyte-source
9.9.10
by nikhilkaushikop
Live on npm
Blocked by Socket
The code is engaging in potentially malicious behavior by collecting and sending sensitive system and user information to suspicious domains without user consent.
iberia-tools
999.9.9
by amigomioteconsidero25
Removed from npm
Blocked by Socket
The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.
Live on npm for 2 hours and 17 minutes before removal. Socket users were protected even while the package was live.
blossom-yarn-fgz947
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code contains several unusual elements including strange package names, inconsistent naming conventions, and a lack of meaningful logic. These characteristics suggest that the code may be obfuscated or intentionally confusing. The peculiar package names could also indicate potential typosquatting. Without more information on the packages being imported, it's difficult to fully assess the intent of the code. However, given the anomalies, there is a moderate security risk associated with this code.
Live on npm for 56 days, 18 hours and 45 minutes before removal. Socket users were protected even while the package was live.
xo-form-components
88.8.8
by agentsteal
Removed from npm
Blocked by Socket
This script is designed to exfiltrate sensitive information from the system to a remote server, indicating malicious behavior.
Live on npm for 39 minutes before removal. Socket users were protected even while the package was live.
int_stripe_sfra
99.9.9
by 0xwise64
Removed from npm
Blocked by Socket
The script collects information like hostname, platform, user info, and current working directory, encodes it in base64, and sends it to a remote server.
Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.
znowflake_client
1.1.9
by Gandalf
Live on Rubygems
Blocked by Socket
This file collects critical system information—including environment variables, user login, local IP, and an external IP (via hxxps://api[.]ipify[.]org)—and sends it to hxxp://example[.]com/2819d620-cd87-4bc0-8b37-fe25d461e06f without user knowledge or consent, posing a significant risk of data exfiltration.
psn-discount-today733
1.0.2
by sicrap
Removed from npm
Blocked by Socket
The script is not necessarily malicious, but it does involve dubious practices like automated publishing of npm packages and programmatically updating a WordPress site. It is also insecure due to the hardcoding of credentials and the potential misuse of automated npm package publishing.
Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.
g8untcotribwatch
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.
plans-grid
1.0.0
by k4r1it0
Removed from npm
Blocked by Socket
The code collects and sends potentially sensitive system data to a remote server without user consent, which is indicative of malicious behavior. This poses a significant security risk due to unauthorized data transmission.
Live on npm for 2 days, 7 hours and 21 minutes before removal. Socket users were protected even while the package was live.
fast
2.5
Removed from PyPI
Blocked by Socket
The script contains several security risks, including hardcoded credentials, use of `eval` with user-supplied data, and dynamic execution of a shell command with user-supplied data. These can lead to credential exposure, code injection, and command injection vulnerabilities. While the primary purpose of the script seems benign, these security risks are significant and should be addressed.
Live on PyPI for 59 minutes before removal. Socket users were protected even while the package was live.
public-api-signature-calculator-example
1.0.0
by antraxio
Removed from npm
Blocked by Socket
The script sends the hostname and the current user to an external server, which is a clear indication of malicious behavior and data exfiltration.
Live on npm for 10 days, 11 hours and 10 minutes before removal. Socket users were protected even while the package was live.
io.github.xz-java:xz-java
1.9.2
Live on Maven
Blocked by Socket
The file contains malicious code that opens a `ServerSocket` on port 11337 and listens for incoming network connections. Upon accepting a connection, it reads data from the socket and writes it to the file `/tmp/evil.sh`. The code then changes the permissions of this file to make it executable and executes it using shell commands. The execution output is written to `/tmp/evil-out.sh`. Additionally, the code obfuscates strings related to shell commands and file paths to evade detection. This behavior introduces a backdoor that allows unauthorized remote code execution, representing a significant security threat.
ai-metrics-advisor
99.10.9
Removed from npm
Blocked by Socket
The code exhibits clear signs of malicious behavior involving data theft and exfiltration. It encodes and sends sensitive system and user data to a suspicious domain via both DNS queries and HTTPS POST requests.
Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.
viihdeonline-shared-components
1.9.99
by dojo-common
Removed from npm
Blocked by Socket
The script collects information like package name, current working directory, username, hostname, and IP address, then sends it to a remote server using DNS requests.
jazz_services-handler
12.0.0
by ganesha_gouri
Removed from npm
Blocked by Socket
This script is designed to exfiltrate environment variables to an external server, which poses a significant security risk and indicates malicious behavior.
Live on npm for 12 days and 7 minutes before removal. Socket users were protected even while the package was live.
@buffer-mono/png-export
10.999.1
by bughunter00
Removed from npm
Blocked by Socket
The code is exfiltrating sensitive system information to an external server, which is a serious security risk and indicative of malicious behavior.
Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.
azure-graphrbac
6.1.1000
Removed from npm
Blocked by Socket
The code is highly suspicious due to its behavior of sending system and project data to external servers without user consent. This indicates potential malicious intent and poses a significant security risk.
Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.
raid-shadow-legends-promo-codes497
1.0.2
by robowxw
Removed from npm
Blocked by Socket
The code poses a significant security risk and should be reviewed. It is recommended to remove unnecessary imports, verify the contents of the data folder and the WordPress websites before proceeding, and avoid using hardcoded credentials for WordPress login.
Live on npm for 54 minutes before removal. Socket users were protected even while the package was live.
sparrow-python
0.4.1
Live on PyPI
Blocked by Socket
The code contains dynamic URL alterations and uses 'os.system' with user inputs, posing a security risk. It is recommended to review the code for safer alternatives.
discord.js-self-v21
1.0.1
by discord-js-selfbotv4
Removed from npm
Blocked by Socket
The code exhibits behavior that is highly indicative of malicious intent, such as downloading and executing files from a remote server without proper validation or user consent. The use of a Discord CDN URL for distributing executables and the absence of integrity checks significantly increase the risk of introducing malware into the system.
Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.
nirvana-dynamo-iun076
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code imports multiple modules with unusual names and calls a method named 'functame' on each of them. The lack of documentation, unconventional naming patterns, and the mysterious method names make this code suspicious. Without additional information on what these modules and methods do, the code could potentially be harmful.
Live on npm for 57 days, 6 hours and 53 minutes before removal. Socket users were protected even while the package was live.
godaddy-utils
999.9.9
by amigomioteconsidero20
Removed from npm
Blocked by Socket
The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.
Live on npm for 1 hour and 47 minutes before removal. Socket users were protected even while the package was live.
Socket detects traditional vulnerabilities (CVEs) but goes beyond that to scan the actual code of dependencies for malicious behavior. It proactively detects and blocks 70+ signals of supply chain risk in open source code, for comprehensive protection.
Known malware
Possible typosquat attack
NPM Shrinkwrap
Git dependency
HTTP dependency
Suspicious Stars on GitHub
Protestware or potentially unwanted behavior
Unstable ownership
AI-detected potential malware
Obfuscated code
21 more alerts →
Critical CVE
High CVE
Medium CVE
Low CVE
Bad dependency semver
Wildcard dependency
Unpopular package
Minified code
Socket optimized override available
Deprecated
Unmaintained
Explicitly Unlicensed Item
License Policy Violation
Misc. License Issues
Non-permissive License
Ambiguous License Classifier
Copyleft License
Unidentified License
No License Found
License exception
Socket detects and blocks malicious dependencies, often within just minutes of them being published to public registries, making it the most effective tool for blocking zero-day supply chain attacks.
Socket is built by a team of prolific open source maintainers whose software is downloaded over 1 billion times per month. We understand how to build tools that developers love. But don’t take our word for it.
Nat Friedman
CEO at GitHub
Suz Hinton
Senior Software Engineer at Stripe
heck yes this is awesome!!! Congrats team 🎉👏
Matteo Collina
Node.js maintainer, Fastify lead maintainer
So awesome to see @SocketSecurity launch with a fresh approach! Excited to have supported the team from the early days.
DC Posch
Director of Technology at AppFolio, CTO at Dynasty
This is going to be super important, especially for crypto projects where a compromised dependency results in stolen user assets.
Luis Naranjo
Software Engineer at Microsoft
If software supply chain attacks through npm don't scare the shit out of you, you're not paying close enough attention.
@SocketSecurity sounds like an awesome product. I'll be using socket.dev instead of npmjs.org to browse npm packages going forward
Elena Nadolinski
Founder and CEO at Iron Fish
Huge congrats to @SocketSecurity! 🙌
Literally the only product that proactively detects signs of JS compromised packages.
Joe Previte
Engineering Team Lead at Coder
Congrats to @feross and the @SocketSecurity team on their seed funding! 🚀 It's been a big help for us at @CoderHQ and we appreciate what y'all are doing!
Josh Goldberg
Staff Developer at Codecademy
This is such a great idea & looks fantastic, congrats & good luck @feross + team!
The best security teams in the world use Socket to get visibility into supply chain risk, and to build a security feedback loop into the development process.
Scott Roberts
CISO at UiPath
As a happy Socket customer, I've been impressed with how quickly they are adding value to the product, this move is a great step!
Yan Zhu
Head of Security at Brave, DEFCON, EFF, W3C
glad to hear some of the smartest people i know are working on (npm, etc.) supply chain security finally :). @SocketSecurity
Andrew Peterson
CEO and Co-Founder at Signal Sciences (acq. Fastly)
How do you track the validity of open source software libraries as they get updated? You're prob not. Check out @SocketSecurity and the updated tooling they launched.
Supply chain is a cluster in security as we all know and the tools from Socket are "duh" type tools to be implementing. Check them out and follow Feross Aboukhadijeh to see more updates coming from them in the future.
Zbyszek Tenerowicz
Senior Security Engineer at ConsenSys
socket.dev is getting more appealing by the hour
Devdatta Akhawe
Head of Security at Figma
The @SocketSecurity team is on fire! Amazing progress and I am exciting to see where they go next.
Sebastian Bensusan
Engineer Manager at Stripe
I find it surprising that we don't have _more_ supply chain attacks in software:
Imagine your airplane (the code running) was assembled (deployed) daily, with parts (dependencies) from internet strangers. How long until you get a bad part?
Excited for Socket to prevent this
Adam Baldwin
VP of Security at npm, Red Team at Auth0/Okta
Congrats to everyone at @SocketSecurity ❤️🤘🏻
Nico Waisman
CISO at Lyft
This is an area that I have personally been very focused on. As Nat Friedman said in the 2019 GitHub Universe keynote, Open Source won, and every time you add a new open source project you rely on someone else code and you rely on the people that build it.
This is both exciting and problematic. You are bringing real risk into your organization, and I'm excited to see progress in the industry from OpenSSF scorecards and package analyzers to the company that Feross Aboukhadijeh is building!
Depend on Socket to prevent malicious open source dependencies from infiltrating your app.
Install the Socket GitHub App in just 2 clicks and get protected today.
Block 70+ issues in open source code, including malware, typo-squatting, hidden code, misleading packages, permission creep, and more.
Reduce work by surfacing actionable security information directly in GitHub. Empower developers to make better decisions.
Attackers have taken notice of the opportunity to attack organizations through open source dependencies. Supply chain attacks rose a whopping 700% in the past year, with over 15,000 recorded attacks.
Dec 14, 2023
Hijacked cryptocurrency library adds malware
Widely-used library in cryptocurrency frontend was compromised to include wallet-draining code, following the hijacking of NPM account credentials via phishing.
Jan 06, 2022
Maintainer intentionally adds malware
Rogue maintainer sabotages his own open source package with 100M downloads/month, notably breaking Amazon's AWS SDK.
Nov 15, 2021
npm discovers a platform vulnerability allowing unauthorized publishing of any package
Attackers could publish new versions of any npm package without authorization for multiple years.
Oct 22, 2021
Hijacked package adds cryptominers and password-stealing malware
Multiple packages with 30M downloads/month are hijacked and publish malicious versions directly into the software supply chain.
Nov 26, 2018
Package hijacked adding organization specific backdoors
Obfuscated malware added to a dependency which targeted a single company, went undetected for over a week, and made it into their production build.
Get our latest security research, open source insights, and product updates.
Security News
More than half of CISOs now manage 10+ security areas, often with few legal safeguards and short tenures, yet continue to secure budgets and higher pay.
Security News
Libxml2’s solo maintainer drops embargoed security fixes, highlighting the burden on unpaid volunteers who keep critical open source software secure.
Research
Security News
Socket investigates hidden protestware in npm packages that blocks user interaction and plays the Ukrainian anthem for Russian-language visitors.
