Secure your dependencies. Ship with confidence.

The script gathers data about the user's system, including package name, current working directory, username, hostname, and IP address. This data is then encoded and sent as DNS queries to a remote server.

Live on npm for 13 hours and 54 minutes before removal. Socket users were protected even while the package was live.

The code is malicious, performing unauthorized collection and encrypted exfiltration of sensitive system and network information to a hardcoded Discord webhook. This represents a significant security risk and privacy breach. The obfuscation and encryption are likely intended to evade detection. The package containing this code should be considered compromised and untrustworthy.

The code is designed to collect and exfiltrate sensitive system information to a potentially malicious server. It executes shell commands to gather data and sends it over the network, indicating a high risk of malicious intent.

Live on npm for 12 days, 23 hours and 18 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates clear malicious intent by exfiltrating sensitive data without user consent. It poses a significant security risk due to the potential for data theft and unauthorized access to system information.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

The code includes suspicious activities such as fetching data from remote URLs, encrypting files, and writing data to files, which could indicate malicious behavior. The security risk is significant due to potential data theft, unauthorized access, and file manipulation. It is recommended to further investigate and potentially remove this code.

Live on npm for 5 hours and 1 minute before removal. Socket users were protected even while the package was live.

The code exhibits suspicious and potentially malicious behavior, including exfiltration of URL-derived data to an external domain, manipulation of window.name for possible data leakage or session hijacking, forced page reload, and injection of extension script code. The lack of validation and the external fetch to a suspicious domain strongly suggest a security risk. The code is not obfuscated but should be treated as high risk and potentially malware.

The code is designed to collect and send sensitive information to a remote server without the user's knowledge or consent. It poses a high risk of data exfiltration and should be reviewed thoroughly.

Live on npm for 52 minutes before removal. Socket users were protected even while the package was live.

The source code exhibits behavior consistent with data exfiltration malware. It collects sensitive system information and sends it to external endpoints without user consent, posing a significant security risk.

Live on npm for 6 days, 20 hours and 6 minutes before removal. Socket users were protected even while the package was live.

This file's script reads the /etc/passwd file and sends its contents to nkbri3r9b8ddoze1m3pfjzhcc3it6i[.]burp[.]gdsburp[.]com via a POST request, clearly indicating malicious data exfiltration.

This code poses a serious security risk and should not be used.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.

The code is involved in unauthorized data exfiltration by sending system and project information to external servers. The domains used are not recognized as safe, indicating potential malicious intent.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code defines a custom installation command that, during the installation process, collects the system's hostname (via socket.gethostname()), current working directory (via os.getcwd()), and the username (via getpass.getuser()). This information is then transmitted using an HTTP GET request to an external server at https://burpcollaborator[.]net. This unauthorized data exfiltration poses a significant security risk by potentially leaking sensitive system information without the user's consent.

Live on PyPI for 44 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect sensitive system information and transmit it to an external server using obfuscated methods. This behavior is indicative of malicious activity, specifically data exfiltration.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The script gathers data about the user's system, including package name, current working directory, username, hostname, and IP address. This data is then encoded and sent as DNS queries to a remote server.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 45 minutes before removal. Socket users were protected even while the package was live.

The code contains suspicious elements such as obfuscation, hardcoded base64 encoded strings, and execution of commands via child processes. While not definitively malicious, it poses a significant security risk and warrants a thorough review.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code is designed to exfiltrate environment variables to a remote server if certain conditions are met, indicative of malicious behavior. The obfuscation of the destination server and the base64 encoding of the data are techniques to obscure the data being exfiltrated.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

The code snippet exhibits malicious behavior by sending the current working directory to an external domain without user consent. This poses a significant security risk due to unauthorized data exfiltration.

Extremely obfuscated code that prevents meaningful security analysis. The level of obfuscation alone indicates high security risk and potential malicious intent. Recommend immediate quarantine and specialized malware analysis.

This script exfiltrates the contents of the system’s '/etc/passwd' file by sending it to a malicious URL (e.g., $(hostname).example[.]com) via cURL during its 'preinstall' phase, demonstrating clear malicious intent.

Live on npm for 4 hours and 31 minutes before removal. Socket users were protected even while the package was live.

The code exhibits several suspicious behaviors: it uses eval with dynamically decoded content, obfuscates variable and method names, and performs complex numeric operations to obscure its true functionality. These patterns are common in malicious scripts designed to evade detection. Therefore, further scrutiny and caution are advised before executing or incorporating this code.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk as it decodes and executes a script from an obfuscated source without validation. This behavior can potentially execute malicious code, making it highly risky.

Live on npm for 3 days, 2 hours and 35 minutes before removal. Socket users were protected even while the package was live.

The script is designed to send sensitive information to a remote server, which is a clear indication of malicious behavior.

Live on npm for 10 days and 5 minutes before removal. Socket users were protected even while the package was live.

The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.

Live on npm for 2 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious as it establishes a reverse shell to an external server, which is a common technique used in malware for remote control. The presence of hardcoded addresses and ports, along with the shell execution, strongly indicates malicious intent.

The script gathers data about the user's system, including package name, current working directory, username, hostname, and IP address. This data is then encoded and sent as DNS queries to a remote server.

Live on npm for 13 hours and 54 minutes before removal. Socket users were protected even while the package was live.

The code is malicious, performing unauthorized collection and encrypted exfiltration of sensitive system and network information to a hardcoded Discord webhook. This represents a significant security risk and privacy breach. The obfuscation and encryption are likely intended to evade detection. The package containing this code should be considered compromised and untrustworthy.

The code is designed to collect and exfiltrate sensitive system information to a potentially malicious server. It executes shell commands to gather data and sends it over the network, indicating a high risk of malicious intent.

Live on npm for 12 days, 23 hours and 18 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates clear malicious intent by exfiltrating sensitive data without user consent. It poses a significant security risk due to the potential for data theft and unauthorized access to system information.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

The code includes suspicious activities such as fetching data from remote URLs, encrypting files, and writing data to files, which could indicate malicious behavior. The security risk is significant due to potential data theft, unauthorized access, and file manipulation. It is recommended to further investigate and potentially remove this code.

Live on npm for 5 hours and 1 minute before removal. Socket users were protected even while the package was live.

The code exhibits suspicious and potentially malicious behavior, including exfiltration of URL-derived data to an external domain, manipulation of window.name for possible data leakage or session hijacking, forced page reload, and injection of extension script code. The lack of validation and the external fetch to a suspicious domain strongly suggest a security risk. The code is not obfuscated but should be treated as high risk and potentially malware.

The code is designed to collect and send sensitive information to a remote server without the user's knowledge or consent. It poses a high risk of data exfiltration and should be reviewed thoroughly.

Live on npm for 52 minutes before removal. Socket users were protected even while the package was live.

The source code exhibits behavior consistent with data exfiltration malware. It collects sensitive system information and sends it to external endpoints without user consent, posing a significant security risk.

Live on npm for 6 days, 20 hours and 6 minutes before removal. Socket users were protected even while the package was live.

This file's script reads the /etc/passwd file and sends its contents to nkbri3r9b8ddoze1m3pfjzhcc3it6i[.]burp[.]gdsburp[.]com via a POST request, clearly indicating malicious data exfiltration.

This code poses a serious security risk and should not be used.

Live on npm for 17 minutes before removal. Socket users were protected even while the package was live.

The code is involved in unauthorized data exfiltration by sending system and project information to external servers. The domains used are not recognized as safe, indicating potential malicious intent.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code defines a custom installation command that, during the installation process, collects the system's hostname (via socket.gethostname()), current working directory (via os.getcwd()), and the username (via getpass.getuser()). This information is then transmitted using an HTTP GET request to an external server at https://burpcollaborator[.]net. This unauthorized data exfiltration poses a significant security risk by potentially leaking sensitive system information without the user's consent.

Live on PyPI for 44 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect sensitive system information and transmit it to an external server using obfuscated methods. This behavior is indicative of malicious activity, specifically data exfiltration.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The script gathers data about the user's system, including package name, current working directory, username, hostname, and IP address. This data is then encoded and sent as DNS queries to a remote server.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 45 minutes before removal. Socket users were protected even while the package was live.

The code contains suspicious elements such as obfuscation, hardcoded base64 encoded strings, and execution of commands via child processes. While not definitively malicious, it poses a significant security risk and warrants a thorough review.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code is designed to exfiltrate environment variables to a remote server if certain conditions are met, indicative of malicious behavior. The obfuscation of the destination server and the base64 encoding of the data are techniques to obscure the data being exfiltrated.

Live on npm for 7 minutes before removal. Socket users were protected even while the package was live.

The code snippet exhibits malicious behavior by sending the current working directory to an external domain without user consent. This poses a significant security risk due to unauthorized data exfiltration.

Extremely obfuscated code that prevents meaningful security analysis. The level of obfuscation alone indicates high security risk and potential malicious intent. Recommend immediate quarantine and specialized malware analysis.

This script exfiltrates the contents of the system’s '/etc/passwd' file by sending it to a malicious URL (e.g., $(hostname).example[.]com) via cURL during its 'preinstall' phase, demonstrating clear malicious intent.

Live on npm for 4 hours and 31 minutes before removal. Socket users were protected even while the package was live.

The code exhibits several suspicious behaviors: it uses eval with dynamically decoded content, obfuscates variable and method names, and performs complex numeric operations to obscure its true functionality. These patterns are common in malicious scripts designed to evade detection. Therefore, further scrutiny and caution are advised before executing or incorporating this code.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code poses a significant security risk as it decodes and executes a script from an obfuscated source without validation. This behavior can potentially execute malicious code, making it highly risky.

Live on npm for 3 days, 2 hours and 35 minutes before removal. Socket users were protected even while the package was live.

The script is designed to send sensitive information to a remote server, which is a clear indication of malicious behavior.

Live on npm for 10 days and 5 minutes before removal. Socket users were protected even while the package was live.

The code is designed to exfiltrate system information by sending it to an external domain via DNS queries. This is a clear indication of malicious behavior, as it involves unauthorized data transmission without user consent.

Live on npm for 2 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious as it establishes a reverse shell to an external server, which is a common technique used in malware for remote control. The presence of hardcoded addresses and ports, along with the shell execution, strongly indicates malicious intent.