Secure your dependencies. Ship with confidence.

Malicious code in roblox-es6-migration-helper (npm) Source: ghsa-malware (0e6744d30670c11b6c78c162fbf812373252b628ed5af3977d02003b1d7711c9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 58 minutes before removal. Socket users were protected even while the package was live.

The script seems to be part of a spamming operation and uses bad security practices, such as hardcoding paths and credentials. Therefore, it's a potential security risk.

Live on npm for 3 days, 17 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The code contains serious security and privacy issues, including hardcoded credentials and the collection of potentially sensitive system information. While the intent doesn't seem overtly malicious, these practices pose significant risks.

Live on npm for 12 days and 1 minute before removal. Socket users were protected even while the package was live.

The source code exhibits behavior consistent with data exfiltration malware. It collects sensitive system information and sends it to external endpoints without user consent, posing a significant security risk.

Live on npm for 3 days, 14 hours and 25 minutes before removal. Socket users were protected even while the package was live.

The code is likely intended for malicious purposes, as it seems to exfiltrate data to a server with hardcoded credentials. The existence of potentially sensitive file extensions such as '.env' among others indicates the possibility of targeted data theft.

Live on npm for 35 minutes before removal. Socket users were protected even while the package was live.

This code is intentionally obfuscated and uses DNS queries to exfiltrate system information, which could be a significant security risk. The hardcoded domain and the potential data exfiltration raise concerns about privacy violations. This package should be reviewed carefully before being used.

Malicious code in docupload (npm) Source: ghsa-malware (67162d52cf528df828bdd0efdf7165e3f51fbbbb09d41014c1620d8e1aaecd80) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Source: ossf-package-analysis (66244e6195655d9fbba980a148e2ddd992bad34916b2d4e4c0bba4f8afbe788b) The OpenSSF Package Analysis project identified 'docupload' @ 5.0.8 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Live on npm for 10 minutes before removal. Socket users were protected even while the package was live.

Malicious code in whjr-analytics (npm) Source: ghsa-malware (b9dce9c9aaa9e383fef4277d3ac40c8e55558803e648049e419c0f3370b4cec1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 1 minute before removal. Socket users were protected even while the package was live.

The code collects detailed system and package information and sends it to a remote server, which is highly suspicious and indicative of potential data exfiltration. The server hostname (oastify.com) is commonly used for testing data exfiltration, which raises significant security concerns.

Live on npm for 2 days, 8 hours and 40 minutes before removal. Socket users were protected even while the package was live.

Malicious code in component-examples (npm) Source: ghsa-malware (525e90b77d9794e6eaeb7b0ad0c70481ca70086b882fe64d2dd07d0e29abc00d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours and 59 minutes before removal. Socket users were protected even while the package was live.

Malicious code in hypercore-bisect (npm) Source: ghsa-malware (aa6c426802a08622622abe2c993f34a0ee3e0efa2c2b56fa694946e1ae3948ea) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in oug-cookie (npm) Source: ghsa-malware (32f2737bb95d80faafd4c2328aa6bcc15c369b3c65200d1147d542b6a9b2db04) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 9 minutes before removal. Socket users were protected even while the package was live.

This code sends all system environment variables to fd067a36f296[.]ngrok[.]io via an HTTPS POST request, potentially leaking sensitive information such as credentials and API keys without user consent. The presence of a conditional check on a specific environment variable further indicates intentional data exfiltration behavior.

Live on npm for 2 days, 7 hours and 41 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours and 37 minutes before removal. Socket users were protected even while the package was live.

Malicious code in e2e-test-repo (npm) Source: ghsa-malware (6572edea50875b7a4383ee4b7dbed53e89120ed815f6699c7033f43c636fc189) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in toneo (PyPI)

Live on PyPI for 11 hours and 5 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 6 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The package's "package.json" file includes a "preinstall" script that attempts to exfiltrate the "/etc/shadow" file by sending it to a dynamically constructed URL using "curl". The script sends the contents of "/etc/shadow" to "$(hostname)uzbsomiaulpyeqwgzyaurf7k8udsmjrvy[.]oast[.]fun", where "$(hostname)" is replaced with the local system's hostname. This behavior is highly malicious as it attempts to steal sensitive system password hashes.

Live on npm for 26 days, 15 hours and 1 minute before removal. Socket users were protected even while the package was live.

Malicious code in internal_pkg_dc_lib (npm) Source: ghsa-malware (0d21f614c511da1ecb823d99dc33d0fc1cdb4dbba8164a2badf4f7f9debe8a71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours and 5 minutes before removal. Socket users were protected even while the package was live.

The code contains explicit malicious behavior in the form of an HTTP DDoS attack function. It also presents security risks due to the use of `os.system` for executing commands that might be controlled by user input and the potential misuse of the Discord API. Therefore, this package should be considered dangerous and not used.

Malicious code in ac-toolkit (npm) Source: ghsa-malware (1cafbe8978f178ead2812d3adb9c55bd5e038635bfb64b44571802997f98b1f3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 10 hours and 6 minutes before removal. Socket users were protected even while the package was live.

Malicious code in cagov-template-v6 (npm) Source: ossf-package-analysis (a3e81e15d59085cf12a3a46a1dc253df8e81c9ff8756d76f8ab9db14b82caab8) The OpenSSF Package Analysis project identified 'cagov-template-v6' @ 9.1.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Live on npm for 7 hours and 18 minutes before removal. Socket users were protected even while the package was live.

Malicious code in bv-framework-sites (npm) Source: ghsa-malware (985ac2de353ac2ba763253a91033deba10e0f1d874b1c194fcc3691a914d0ffb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in swaty-color (npm) Source: ghsa-malware (749dbce98e920622a098d9bf119a167053ad8bcfbcacc9838bc509a856a06a7e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 24 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours before removal. Socket users were protected even while the package was live.

Malicious code in roblox-es6-migration-helper (npm) Source: ghsa-malware (0e6744d30670c11b6c78c162fbf812373252b628ed5af3977d02003b1d7711c9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 58 minutes before removal. Socket users were protected even while the package was live.

The script seems to be part of a spamming operation and uses bad security practices, such as hardcoding paths and credentials. Therefore, it's a potential security risk.

Live on npm for 3 days, 17 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The code contains serious security and privacy issues, including hardcoded credentials and the collection of potentially sensitive system information. While the intent doesn't seem overtly malicious, these practices pose significant risks.

Live on npm for 12 days and 1 minute before removal. Socket users were protected even while the package was live.

The source code exhibits behavior consistent with data exfiltration malware. It collects sensitive system information and sends it to external endpoints without user consent, posing a significant security risk.

Live on npm for 3 days, 14 hours and 25 minutes before removal. Socket users were protected even while the package was live.

The code is likely intended for malicious purposes, as it seems to exfiltrate data to a server with hardcoded credentials. The existence of potentially sensitive file extensions such as '.env' among others indicates the possibility of targeted data theft.

Live on npm for 35 minutes before removal. Socket users were protected even while the package was live.

This code is intentionally obfuscated and uses DNS queries to exfiltrate system information, which could be a significant security risk. The hardcoded domain and the potential data exfiltration raise concerns about privacy violations. This package should be reviewed carefully before being used.

Malicious code in docupload (npm) Source: ghsa-malware (67162d52cf528df828bdd0efdf7165e3f51fbbbb09d41014c1620d8e1aaecd80) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Source: ossf-package-analysis (66244e6195655d9fbba980a148e2ddd992bad34916b2d4e4c0bba4f8afbe788b) The OpenSSF Package Analysis project identified 'docupload' @ 5.0.8 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Live on npm for 10 minutes before removal. Socket users were protected even while the package was live.

Malicious code in whjr-analytics (npm) Source: ghsa-malware (b9dce9c9aaa9e383fef4277d3ac40c8e55558803e648049e419c0f3370b4cec1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 1 minute before removal. Socket users were protected even while the package was live.

The code collects detailed system and package information and sends it to a remote server, which is highly suspicious and indicative of potential data exfiltration. The server hostname (oastify.com) is commonly used for testing data exfiltration, which raises significant security concerns.

Live on npm for 2 days, 8 hours and 40 minutes before removal. Socket users were protected even while the package was live.

Malicious code in component-examples (npm) Source: ghsa-malware (525e90b77d9794e6eaeb7b0ad0c70481ca70086b882fe64d2dd07d0e29abc00d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours and 59 minutes before removal. Socket users were protected even while the package was live.

Malicious code in hypercore-bisect (npm) Source: ghsa-malware (aa6c426802a08622622abe2c993f34a0ee3e0efa2c2b56fa694946e1ae3948ea) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in oug-cookie (npm) Source: ghsa-malware (32f2737bb95d80faafd4c2328aa6bcc15c369b3c65200d1147d542b6a9b2db04) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 9 minutes before removal. Socket users were protected even while the package was live.

This code sends all system environment variables to fd067a36f296[.]ngrok[.]io via an HTTPS POST request, potentially leaking sensitive information such as credentials and API keys without user consent. The presence of a conditional check on a specific environment variable further indicates intentional data exfiltration behavior.

Live on npm for 2 days, 7 hours and 41 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours and 37 minutes before removal. Socket users were protected even while the package was live.

Malicious code in e2e-test-repo (npm) Source: ghsa-malware (6572edea50875b7a4383ee4b7dbed53e89120ed815f6699c7033f43c636fc189) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in toneo (PyPI)

Live on PyPI for 11 hours and 5 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 6 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The package's "package.json" file includes a "preinstall" script that attempts to exfiltrate the "/etc/shadow" file by sending it to a dynamically constructed URL using "curl". The script sends the contents of "/etc/shadow" to "$(hostname)uzbsomiaulpyeqwgzyaurf7k8udsmjrvy[.]oast[.]fun", where "$(hostname)" is replaced with the local system's hostname. This behavior is highly malicious as it attempts to steal sensitive system password hashes.

Live on npm for 26 days, 15 hours and 1 minute before removal. Socket users were protected even while the package was live.

Malicious code in internal_pkg_dc_lib (npm) Source: ghsa-malware (0d21f614c511da1ecb823d99dc33d0fc1cdb4dbba8164a2badf4f7f9debe8a71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours and 5 minutes before removal. Socket users were protected even while the package was live.

The code contains explicit malicious behavior in the form of an HTTP DDoS attack function. It also presents security risks due to the use of `os.system` for executing commands that might be controlled by user input and the potential misuse of the Discord API. Therefore, this package should be considered dangerous and not used.

Malicious code in ac-toolkit (npm) Source: ghsa-malware (1cafbe8978f178ead2812d3adb9c55bd5e038635bfb64b44571802997f98b1f3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 10 hours and 6 minutes before removal. Socket users were protected even while the package was live.

Malicious code in cagov-template-v6 (npm) Source: ossf-package-analysis (a3e81e15d59085cf12a3a46a1dc253df8e81c9ff8756d76f8ab9db14b82caab8) The OpenSSF Package Analysis project identified 'cagov-template-v6' @ 9.1.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Live on npm for 7 hours and 18 minutes before removal. Socket users were protected even while the package was live.

Malicious code in bv-framework-sites (npm) Source: ghsa-malware (985ac2de353ac2ba763253a91033deba10e0f1d874b1c194fcc3691a914d0ffb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in swaty-color (npm) Source: ghsa-malware (749dbce98e920622a098d9bf119a167053ad8bcfbcacc9838bc509a856a06a7e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 24 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours before removal. Socket users were protected even while the package was live.